Threats tagged 'ghsa-4ph5-mvfm-988x'

The WPSyncSheets For Contact Form 7 plugin for WordPress contains a remote code execution vulnerability in all versions up to and including 1.8.0. The flaw arises from insufficient sanitization of Contact Form 7 submission fields before database storage and lack of restrictions on deserialization during admin retrieval. Exploitation requires a configured Google Sheets access token, which triggers autoloading of a vulnerable Monolog library, enabling unauthenticated attackers to execute code on the server.