CVE-2024-1779CVSS 5.3Web
CVE-2024-1779: admin side data storage for contact form 7 vulnerability
The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the zt_dcfcf_change_status() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to alter the message read status of messages.
- CVSS
- 5.3 MEDIUM
- EPSS
- 31.22%
- Known exploited
- not in KEV
- Product
- admin side data storage for contact form 7
What is known
The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the zt_dcfcf_change_status() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to alter the message read status of messages.