Description
The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7md_dismiss_notice action, allowing any logged in user (with roles as low as Subscriber) to set arbitrary options to true, potentially leading to Denial of Service by breaking the site.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Material Design for Contact Form 7 | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-15549 | The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7md_dismiss_notice action, allowing any logged in user (with roles as low as Subscriber) to set arbitrary options to true, potentially leading to Denial of Service by breaking the site. |
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2024-08-02T23:25:40.617Z
Reserved: 2022-01-28T00:00:00.000Z
Link: CVE-2022-0404
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-04-04T16:15:09.150
Modified: 2024-11-21T06:38:33.290
Link: CVE-2022-0404
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses