CVE-2024-6317: Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion
The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and the plugin not properly validating a file or its path prior to deleting it in the 'wpcf7pdfdashboardhtmlpage' function. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6317?
CVE-2024-6317 has been classified as a high-severity vulnerability due to its potential for arbitrary file uploads.
How do I fix CVE-2024-6317?
To fix CVE-2024-6317, update the Generate PDF using Contact Form 7 plugin to version 4.0.7 or higher.
What versions are affected by CVE-2024-6317?
CVE-2024-6317 affects all versions of the Generate PDF using Contact Form 7 plugin up to and including 4.0.6.
What type of vulnerability is CVE-2024-6317?
CVE-2024-6317 is a Cross-Site Request Forgery (CSRF) vulnerability that allows for arbitrary file upload.
What problems can CVE-2024-6317 cause?
CVE-2024-6317 can lead to unauthorized file uploads, potentially compromising the affected WordPress site.