CVE-2024-3723 | THREATINT

Description

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.2 via the wp-content/uploads/advanced-cf7-upload directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via this plugin through a form.

Reserved 2024-04-12 | Published 2024-06-11 | Updated 2024-08-01 | Assigner Wordfence

MEDIUM: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-922 Insecure Storage of Sensitive Information

Product status

Default status

unaffected

affected

Timeline

2024-06-10:

Disclosed

Credits

Tim Coen finder

References

www.wordfence.com/...-4f0a-48b5-80c8-525b69006863?source=cve

wordpress.org/plugins/advanced-cf7-db/

cve.org (CVE-2024-3723)

nvd.nist.gov (CVE-2024-3723)

Download JSON