CVE-2024-12027: Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions
The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateFilter() and deleteFilter() functions in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to update and delete filters.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12027?
CVE-2024-12027 is considered a moderate severity vulnerability due to its potential for unauthorized data modification.
How do I fix CVE-2024-12027?
To fix CVE-2024-12027, you should update the Contact Form 7 Message Filter plugin to version 1.6.4 or later.
What versions are affected by CVE-2024-12027?
CVE-2024-12027 affects all versions of the Message Filter for Contact Form 7 plugin up to and including version 1.6.3.
Who is impacted by CVE-2024-12027?
Authenticated users of the Contact Form 7 Message Filter plugin are impacted by CVE-2024-12027 due to the lack of proper capability checks.
What functions are vulnerable in CVE-2024-12027?
The functions updateFilter() and deleteFilter() are vulnerable in CVE-2024-12027 due to missing capability checks.