CVE-2024-3723 describes a vulnerability in the Advanced Contact form 7 DB plugin for WordPress (versions up to 2.0.2) where sensitive information uploaded through the plugin is stored insecurely in the wp-content/uploads/advanced-cf7-upload directory. This directory is accessible without authentication, allowing attackers to retrieve sensitive data directly. The vulnerability is categorized under CWE-922 (Insecure Storage of Sensitive Information) and has a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating that it is remotely exploitable without privileges or user interaction and impacts confidentiality only. No patch or vendor advisory is currently available, and no exploits are known in the wild.

An unauthenticated attacker can access sensitive files uploaded via the plugin due to improper access controls on the upload directory. This exposure compromises confidentiality of sensitive data but does not affect data integrity or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the wp-content/uploads/advanced-cf7-upload directory via web server configuration (e.g., using .htaccess rules or equivalent) to prevent unauthorized access to uploaded files. Monitoring for updates from the vendor is recommended.