Vulnerability · Published May 14, 2021 · Assigned by WPScan
CVE-2021-24278Redirection for Contact Form 7 < 2.3.4 - Unauthenticated Arbitrary Nonce Generation
High 7.5
In plain English
A high-severity incorrect authorization in Redirection for Contact Form 7 from Query Solutions. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.4% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)7.4%top 5.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Query Solutions | Redirection for Contact Form 7 | 2.3.4 – before 2.3.4 |
Weakness: CWE-863