WordPress Plugin Vulnerabilities

123ContactForm for WordPress <= 1.5.6 - Unauthenticated Arbitrary File Upload

Description

Attackers could use the Unauthenticated Arbitrary Post Creation issue (https://wpscan.com/vulnerability/d3ef5644-1044-492f-ac23-ea90b32f1e77) to also upload a PHP file via the cfp_upload_image() function which fails to properly verify that the file provided is an image.

Affects Plugins

Plugin icon
123contactform-for-wordpress
No known fix

References

URL
https://blog.sucuri.net/2021/01/critical-vulnerabilities-in-123contactform-for-wordpress-wordpress-plugin.html

Miscellaneous

Original Researcher
Rodrigo Escobar (Sucuri)
Verified
No
WPVDB ID
0b58b722-e75a-4dc2-b63b-35375f475344

Timeline

Publicly Published
2021-01-20 (about 3 years ago)
Added
2021-01-20 (about 3 years ago)
Last Updated
2021-01-21 (about 3 years ago)

Other

Published
Title
Published
2023-10-09
Title
Royal Elementor Addons and Templates 1.4.78 - Unauthenticated Arbitrary File Upload
Published
2014-08-01
Title
Amoveo - Arbitrary File Upload
Published
2022-12-05
Title
Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload
Published
2014-08-01
Title
Monsters Editor - Arbitrary File Upload
Published
2015-06-10
Title
N-Media File Uploader <= 3.7 - Arbitrary File Upload