Ultra Addons for Contact Form 7 arbitrary file deletion
A WordPress contact form plugin lets anyone delete files on the server!
Summary
Insufficient file path validation in the Ultra Addons for Contact Form 7 WordPress plugin lets unauthenticated attackers delete arbitrary files on the server. Deleting key files such as wp-config.php can lead to remote code execution. All versions up to and including 3.5.54 are affected.
Affected when
- PDF Generator add-on active
- Contact Form 7 form configured for PDF generation
What to do
Check that the plugin runs a version newer than 3.5.54 and read the vendor's advisory. No fixed version is named in the sources.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen