CF7 Google Sheets Connector, CVE-2024-5654

CVE, Research URL: CVE-2024-5654
Home page URL: Security reports for CF7 Google Sheets Connector
Application: CF7 Google Sheets Connector
Published on: Jun 08, 2024
Research Description: The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'execute_post_data_cg7_free' function in all versions up to, and including, 5.0.9. This makes it possible for unauthenticated attackers to toggle site configuration settings, including WP_DEBUG, WP_DEBUG_LOG, SCRIPT_DEBUG, and SAVEQUERIES.
Affected versions: max 5.0.10.
Status: vulnerable