CVE-2024-1069: Contact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload
The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'viewpage' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1069?
CVE-2024-1069 has a high severity rating due to the risk of arbitrary file uploads.
How do I fix CVE-2024-1069?
To fix CVE-2024-1069, upgrade the Contact Form Entries plugin to version 1.3.3 or later.
Who is affected by CVE-2024-1069?
CVE-2024-1069 affects users of the Contact Form Entries plugin for WordPress prior to version 1.3.3.
What type of attack does CVE-2024-1069 enable?
CVE-2024-1069 enables authenticated attackers with administrator-level capabilities to upload arbitrary files.
Which function in the plugin is vulnerable in CVE-2024-1069?
The vulnerability in CVE-2024-1069 is present in the 'view_page' function of the Contact Form Entries plugin.