CVE-2015-1874

MITTEL 6.8CVE-2015-1874 · Published 09/03/2015 · updated 17/06/2026

Kurz gesagt

CVE-2015-1874 ist eine Schwachstelle (MITTEL (CVSS 6.8)) in contact form db (cfdbplugin).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.5%, höher als bei 73.8% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
contact form db cfdbplugin	`= 2.8.31`	No fix yet

Description

Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php.

References

packetstormsecurity.com/files/130654/WordPress-Contact-Form-DB-2.8.29-Cross-Site-Request-Forgery.html · Exploit
seclists.org/fulldisclosure/2015/Mar/21 · Exploit
securityfocus.com/bid/72964 · Third Party Advisory
security.dxw.com/advisories/csrf-in-contact-form-db-allows-attacker-to-delete-all-stored-form-submissions · Exploit
wordpress.org/plugins/contact-form-7-to-database-extension/changelog · Patch

Weitere Schwachstellen in contact form db

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free