CVE-2024-3520
Country State City Dropdown CF7 <= 2.7.1 - Missing Authorization
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 4.3EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
02 may 2024Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tc_csca_patch_settings function in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with subscriber access and above, to add states or cities to the dropdown.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Productos afectados
trustyplugins · Country State City Dropdown CF7¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →