CVE-2021-24278

High

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to…

WPScan·CWE-863·Published 2021-05-14

CVSS

7.5

EPSS

0.07

KEV

Exploits

cve.orgen

192 chars

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.

NVDen

192 chars

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.

En el plugin de WordPress Redirection for Contact Form versiones 7 anteriores a 2.3.4, los usuarios no autenticados pueden usar la acción AJAX wpcf7r_get_nonce para recuperar un nonce válido para cualquier acción o función de WordPress

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	5.0	10.0	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N
3.1	Primary	NVD	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N