Threats tagged 'ghsa-6868-g34r-2xq9'

The Redirection for Contact Form 7 WordPress plugin contains an authorization bypass vulnerability in all versions up to and including 3.2.14. This flaw allows unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy server-side files with allowed MIME types into the plugin's uploads directory. Exploitation requires a Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site.