Vulnerability in WordPress Plugin Puts Thousands of Websites at Risk

A vulnerability advisory has been issued for a WordPress plugin that saves contact form submissions, enabling unauthenticated attackers to delete files, launch a denial of service attack, or perform remote code execution. The vulnerability has been given a severity rating of 9.8 on a scale of 1 to 10, indicating the seriousness of the issue.

About the Plugin

The plugin in question, known as the Database for Contact Form 7, WPForms, Elementor Forms, or Contact Form Entries Plugin, saves contact form entries into the WordPress database. It allows users to view contact form submissions, search them, mark them as read or unread, export them, and perform other functions. With over 70,000 installations, this plugin is widely used among WordPress users.

How the Vulnerability Works

The plugin is vulnerable to PHP Object Injection by an unauthenticated attacker, which means that an attacker does not need to log in to the website to launch the attack. A PHP object is a data structure in PHP that can be turned into a sequence of characters (serialized) in order to store them and then deserialized (turned back into an object). The flaw that gives rise to this vulnerability is that the plugin allows an unauthenticated attacker to inject an untrusted PHP object.

Consequences of the Vulnerability

If the WordPress site also has the Contact Form 7 plugin installed, then it can trigger a POP chain during deserialization. According to the Wordfence advisory, this makes it possible for unauthenticated attackers to inject a PHP Object, allowing them to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.

Impact and Solution

All versions of the plugin up to and including 1.4.3 are vulnerable. Users are advised to update their plugin to the latest version, which is version 1.4.5. This update is crucial in preventing potential attacks and protecting websites from harm.

Conclusion

The vulnerability in the Database for Contact Form 7, WPForms, Elementor Forms plugin poses a significant threat to thousands of WordPress websites. It is essential for users to update their plugin to the latest version to prevent potential attacks and ensure the security of their websites. By taking this simple step, users can protect their websites from the risks associated with this vulnerability and maintain the integrity of their online presence.