CVE-2024-5804
Cross-Site Request Forgery (CSRF) (CWE-352)
Summary
The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.13. This vulnerability is due to missing or incorrect nonce validation on the wpcf7cf_admin_init function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.
Impact
The impact of this vulnerability is primarily on the integrity of the plugin's settings. An attacker could potentially reset the plugin's configuration, which could disrupt the functionality of contact forms on the affected WordPress site. While the confidentiality of data is not directly compromised, and there's no direct impact on system availability, the manipulation of settings could indirectly affect the usability of the website's contact forms. The attack requires user interaction, specifically from a site administrator, which somewhat limits its scope but also targets users with high privileges.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability affects versions up to and including 2.4.13 of the Conditional Fields for Contact Form 7 plugin. Website administrators should update to a version newer than 2.4.13 to mitigate this vulnerability.
Mitigation
1. Update the Conditional Fields for Contact Form 7 plugin to a version newer than 2.4.13. 2. Educate site administrators about the risks of clicking on unknown links, especially when logged into the WordPress admin panel. 3. Implement additional security measures such as Web Application Firewalls (WAF) that can help detect and prevent CSRF attacks. 4. Regularly review and audit plugin settings to detect any unauthorized changes. 5. Consider implementing additional authentication steps for critical admin functions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Timeline
NVD published the first details for CVE-2024-5804
Feedly found the first article mentioning CVE-2024-5804. See article
Feedly estimated the CVSS score as HIGH
A CVSS base score of 4.3 has been assigned.
This CVE started to trend in security discussions
EPSS Score was set to: 0.05% (Percentile: 21%)
This CVE stopped trending in security discussions