Threats tagged 'ghsa-2g6f-p97f-gp43'

The Conditional Fields for Contact Form 7 WordPress plugin up to version 2.6.7 has an uncontrolled resource consumption vulnerability. This flaw exists in the Wpcf7cfMailParser class where the hide_hidden_mail_fields_regex_callback() method reads an iteration count from user-supplied POST parameters without validation. An unauthenticated attacker can exploit this by sending a large integer via the REST API, causing excessive loop execution and multiple preg_replace() calls that exhaust server memory and crash the PHP process.