WordPress Plugin Vulnerabilities

Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler < 1.6.5 - Missing Authorization via Several AJAX Action

Description

The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions.

Affects Plugins

Plugin icon
cf7-styler
Fixed in 1.6.5

References

CVE
CVE-2024-34826
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/a39679a6-21f1-41e2-aaf8-23f03b79ef33

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Dhabaleshwar Das
Verified
No
WPVDB ID
f988afea-60d1-481f-88eb-472c6a598fe2

Timeline

Publicly Published
2024-05-09 (about 2 years ago)
Added
2024-05-15 (about 2 years ago)
Last Updated
2024-05-15 (about 2 years ago)

Other

Published
Title
Published
2023-12-06
Title
System Dashboard < 2.8.8 - Missing Authorization to Information Disclosure (sd_db_specs)
Published
2025-11-28
Title
Pure WC Variation Swatches <= 1.1.7 - Unauthenticated Settings Update
Published
2026-07-15
Title
WPBot < 8.5.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function
Published
2026-02-21
Title
Image Slider by Ays < 2.7.2 - Missing Authorization
Published
2025-07-22
Title
Omnishop <= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint