CPE Details
Rock Lobster, LLC Contact Form 5.9.3 for WordPress
5.9.3
2024-07-01
16h30 +00:00
16h30 +00:00
2024-07-01
16h30 +00:00
16h30 +00:00
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
CPE Name: cpe:2.3:a:rocklobster:contact_form_7:5.9.3:*:*:*:*:wordpress:*:*
Informations
Vendor
rocklobsterProduct
contact_form_7Version
5.9.3Target Software
wordpressRelated CVE
| CVE ID | Publié | Description | Score | Gravité |
|---|---|---|---|---|
| The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip_spam_check' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order. | 5.3 |
Moyen |
||
| The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and redirect to the URL of their choosing. | 6.1 |
Moyen |
