Vulnerabilities and security researches forwpcf7-redirect wpcf7-redirect

Jun 07, 2024

CVE, Research URL: CVE-2021-24280
Home page URL: Security reports for Redirection for Contact Form 7
Application: Redirection for Contact Form 7
Date: May 14, 2021
Research Description: In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the import_from_debug AJAX action to inject PHP objects.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2021-24279
Home page URL: Security reports for Redirection for Contact Form 7
Application: Redirection for Contact Form 7
Date: May 14, 2021
Research Description: In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to install any plugin from the WordPress repository.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2021-36913
Home page URL: Security reports for Redirection for Contact Form 7
Application: Redirection for Contact Form 7
Date: Oct 11, 2022
Research Description: Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress allows attackers to change options and inject scripts into the footer HTML. Requires an additional extension (plugin) AccessiBe.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2021-24282
Home page URL: Security reports for Redirection for Contact Form 7
Application: Redirection for Contact Form 7
Date: May 14, 2021
Research Description: In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7r_reset_settings to reset the plugin’s settings, wpcf7r_add_action to add actions to a form, and more.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2022-0250
Home page URL: Security reports for Redirection for Contact Form 7
Application: Redirection for Contact Form 7
Date: Jul 04, 2022
Research Description: The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2023-23990
Home page URL: Security reports for Redirection for Contact Form 7
Application: Redirection for Contact Form 7
Date: May 17, 2024
Research Description: Improper Privilege Management vulnerability in Qube One Ltd. Redirection for Contact Form 7 wpcf7-redirect allows Privilege Escalation.This issue affects Redirection for Contact Form 7: from n/a through 2.7.0.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2021-24281
Home page URL: Security reports for Redirection for Contact Form 7
Application: Redirection for Contact Form 7
Date: May 14, 2021
Research Description: In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_action_post AJAX action to delete any post on a target site.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2021-24278
Home page URL: Security reports for Redirection for Contact Form 7
Application: Redirection for Contact Form 7
Date: May 14, 2021
Research Description: In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.
Affected versions: Min -, max -.
Status: vulnerable

Jun 10, 2024

CVE, Research URL: CVE-2023-39920
Home page URL: Security reports for Redirection for Contact Form 7
Application: Redirection for Contact Form 7
Date: Dec 13, 2024
Research Description: Missing Authorization vulnerability in Themeisle Redirection for Contact Form 7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirection for Contact Form 7: from n/a through 2.9.2.
Affected versions: Min -, max -.
Status: vulnerable

Nov 14, 2024

CVE, Research URL: CVE-2022-4974
Home page URL: Security reports for Redirection for Contact Form 7
Application: Redirection for Contact Form 7
Date: Oct 16, 2024
Research Description: The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
Affected versions: Min -, max -.
Status: vulnerable