A critical WordPress plugin vulnerability has been discovered in Contact Form 7. This utility is currently active on over 5 million websites, with approximately 70% of them running the vulnerable 5.3.1 version or an older release.
By exploiting this vulnerability, attackers can bypass the filename sanitization of Contact Form 7 and upload a file that can be executed as a script on the host server.
Contact Form 7 can manage multiple contact forms. You can customize the form and the mail contents simply with the help of it. The form supports Ajax-powered submitting, Akismet spam filtering, and also CAPTCHA.
WordPress allows multiple user roles such as contributors, editors, subscribers, authors, etc. In Contact Form 7, this vulnerability allows attackers to bypass Contact Form 7’s filename sanitization. A user can behave like a contributor and be able to edit the content form. This feature should be available only for editors and admins.
By granting this permission, the attacker possesses the capability to upload malicious code, enabling them to tamper with a database and acquire a reverse shell. This action paves the way for subsequent attacks.
Enable your WAF 2.0 module on the Dashboard, sit back, and enjoy the ultimate server security protection.
Don’t risk your web hosting business! Download BitNinja now and enjoy the free trial with full functionality for 7-days. No credit card needed!
We are always happy to help you! If you have any questions, check out our Knowledgebase; feel free to ask at info@bitninja.io, or you can even reach us on the Dashboard chat!
Have a Hacker-free Festive Season!
