WordPress Plugin Vulnerabilities

Contact Form 7 Database Addon < 1.2.6.1 - Arbitrary Form Deletion via CSRF

Description

The plugin does not have CSRF check when processing bulk actions, which could allow attackers to make logged in admin delete arbitrary forms for example

Affects Plugins

Plugin icon
contact-form-cfdb7
Fixed in 1.2.6.1

References

CVE
CVE-2021-36886
URL
https://plugins.trac.wordpress.org/changeset/2628499

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Ex.Mi
Verified
Yes
WPVDB ID
86a62010-8f0c-45a8-995a-7a41464b3ff3

Timeline

Publicly Published
2021-11-12 (about 4 years ago)
Added
2021-12-22 (about 4 years ago)
Last Updated
2022-04-13 (about 4 years ago)

Other

Published
Title
Published
2023-03-16
Title
Bulk Resize Media <= 1.1 - CSRF
Published
2024-11-28
Title
Photo Video Store <= 21.07 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-12-31
Title
Contact Form Widget <= 1.5.1 - Cross-Site Request Forgery
Published
2025-05-30
Title
Real Time Validation for Gravity Forms <= 1.7.0 - Cross-Site Request Forgery
Published
2024-04-10
Title
Marker.io < 1.1.9 - Cross-Site Request Forgery