CVE-2024-5654: CF7 Google Sheets Connector <= 5.0.9 - Missing Authorization to Limited Site Configuration Update
The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'executepostdatacg7free' function in all versions up to, and including, 5.0.9. This makes it possible for unauthenticated attackers to toggle site configuration settings, including WPDEBUG, WPDEBUGLOG, SCRIPTDEBUG, and SAVEQUERIES.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/cf7-google-sheets-connectorto a version that resolves this vulnerability.Fixed in 5.0.9 - Configuration
Update/patch the plugin so the 'execute_post_data_cg7_free' function performs the missing WordPress capability check before allowing any limited site configuration updates.
CF7 Google Sheets Connector (WordPress plugin) execute_post_data_cg7_free capability check = Add a capability check to ensure only authorized users can execute configuration updates (prevents unauthenticated toggling of WP_DEBUG, WP_DEBUG_LOG, SCRIPT_DEBUG, SAVEQUERIES).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5654?
CVE-2024-5654 is considered a critical vulnerability due to the potential for unauthorized data modification.
How do I fix CVE-2024-5654?
To fix CVE-2024-5654, update the CF7 Google Sheets Connector plugin to version 5.0.10 or later.
Who is affected by CVE-2024-5654?
CVE-2024-5654 affects users of the CF7 Google Sheets Connector plugin for WordPress, specifically all versions up to 5.0.9.
What type of vulnerability is CVE-2024-5654?
CVE-2024-5654 is a security vulnerability related to unauthorized data modification due to a lack of capability checks.
Can CVE-2024-5654 be exploited remotely?
Yes, CVE-2024-5654 can be exploited remotely by unauthenticated attackers.