{"error":0,"message":null,"data":{"name":"Conditional Fields for Contact Form 7","plugin":"cf7-conditional-fields","link":"https:\/\/wordpress.org\/plugins\/cf7-conditional-fields\/","latest":"1788716940","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"9344292078e4be5e9debbb42a86f18cd4de3fa049d117caaaa0fd1595b3847ae","name":"Conditional Fields for Contact Form 7 [cf7-conditional-fields] < 2.4.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.4.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"0bb038577e135241efdec5ee2901e7ead90280e7","name":"Conditional Fields for Contact Form 7 <= 2.4.0 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/cf7-conditional-fields\/conditional-fields-for-contact-form-7-241-missing-authorization","description":"The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when showing admin notices in all versions up to 2.4.0 (inclusive). This makes it possible for attackers to read admin notices.","date":"2023-11-14"}],"impact":[]},{"uuid":"5b38bc4bffd4b6944de7313cbda0694e82a08a4399bb9e9b30047fd9b5b66d46","name":"Conditional Fields for Contact Form 7 [cf7-conditional-fields] < 2.4.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.4.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-47838","name":"CVE-2023-47838","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-47838","description":"[en] Missing Authorization vulnerability in Jules Colle Conditional Fields for Contact Form 7 cf7-conditional-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conditional Fields for Contact Form 7: from n\/a through <= 2.4.1.","date":"2024-12-09"},{"id":"86b001a2806a5d795a1aae6b0476175d138381c0","name":"WordPress  Conditional Fields for Contact Form 7 Plugin  <= 2.4.1 is vulnerable to Broken Access Control","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/cf7-conditional-fields\/vulnerability\/wordpress-conditional-fields-for-contact-form-7-plugin-2-4-broken-access-control-vulnerability","description":"No patched version is available. No reply from the vendor.\nAbdi Pranata discovered and reported this Broken Access Control vulnerability in WordPress Conditional Fields for Contact Form 7 Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has not been known to be fixed yet.","date":"2023-11-16"},{"id":"46896106680f8ba69957b26a6e3319f23e88fe27","name":"Conditional Fields for Contact Form 7 <= 2.4.1 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/cf7-conditional-fields\/conditional-fields-for-contact-form-7-241-missing-authorization-1","description":"The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on an unknown function in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to make use of this function and dismiss notifications intended for admins. There is no security impact.","date":"2023-11-16"},{"id":"ca533e68-5c83-4049-8d9f-020d0d8cd9ea","name":"Conditional Fields for Contact Form 7 &lt; 2.4.2 - Missing Authorization","link":"https:\/\/wpscan.com\/vulnerability\/ca533e68-5c83-4049-8d9f-020d0d8cd9ea","description":"The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on an unknown function in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to make use of this function and dismiss notifications intended for admins. There is no security impact.","date":null},{"id":"EUVD-2023-51933","name":"EUVD-2023-51933","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2023-51933","description":"Missing Authorization vulnerability in Jules Colle Conditional Fields for Contact Form 7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conditional Fields for Contact Form 7: from n\/a through 2.4.1.","date":"2024-12-09"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"4.3","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null},"epss":"0.001"}},{"uuid":"9f9ba471500b2a0d53e7c2cb26a83cc80795da6400be9b0ef1ccfc46459a4988","name":"Conditional Fields for Contact Form 7 [cf7-conditional-fields] < 2.4.14","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.4.14","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-5804","name":"CVE-2024-5804","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-5804","description":"[en] The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.13. This is due to missing or incorrect nonce validation on the wpcf7cf_admin_init function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2024-07-20"},{"id":"fb0050c5701d49ea9e33e5876425fcd747d7c820","name":"Conditional Fields for Contact Form 7 <= 2.4.13 - Cross-Site Request Forgery to Plugin Setting Reset","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/cf7-conditional-fields\/conditional-fields-for-contact-form-7-2413-cross-site-request-forgery-to-plugin-setting-reset","description":"The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.13. This is due to missing or incorrect nonce validation on the wpcf7cf_admin_init function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2024-07-19"},{"id":"2215e0e9a43150e1e81acc8bb6d24daf8c07b761","name":"WordPress Conditional Fields for Contact Form 7 Plugin <= 2.4.13 is vulnerable to Cross Site Request Forgery (CSRF)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/cf7-conditional-fields\/vulnerability\/wordpress-conditional-fields-for-contact-form-7-plugin-2-4-13-cross-site-request-forgery-to-plugin-setting-reset-vulnerability","description":"<p>WordPress Conditional Fields for Contact Form 7 Plugin <= 2.4.13 is vulnerable to Cross Site Request Forgery (CSRF)<\/p><p>Software: Conditional Fields for Contact Form 7<\/p><p>Link: https:\/\/wordpress.org\/plugins\/cf7-conditional-fields\/#developers<\/p><p>Affected Version <= 2.4.13<\/p><p>Fixed in version 2.4.14 <\/p>","date":"2024-07-22"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"n","i":"l","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"cc7ac26251415017d80bc682cae81d4e366b0c0456c8623a6e9d0b9863a45c72","name":"Conditional Fields for Contact Form 7 [cf7-conditional-fields] < 2.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-50412","name":"CVE-2024-50412","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-50412","description":"[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jules Colle Conditional Fields for Contact Form 7 cf7-conditional-fields allows Stored XSS.This issue affects Conditional Fields for Contact Form 7: from n\/a through <= 2.4.15.","date":"2024-10-29"},{"id":"53dd43a0d9837417d84f527beebff9851adfa960","name":"WordPress Conditional Fields for Contact Form 7 Plugin <= 2.4.15 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/cf7-conditional-fields\/vulnerability\/wordpress-conditional-fields-for-contact-form-7-plugin-2-4-15-cross-site-scripting-xss-vulnerability","description":"<p>WordPress Conditional Fields for Contact Form 7 Plugin <= 2.4.15 is vulnerable to Cross Site Scripting (XSS)<\/p><p>Software: Conditional Fields for Contact Form 7<\/p><p>Link: https:\/\/wordpress.org\/plugins\/cf7-conditional-fields\/#developers<\/p><p>Affected Version <= 2.4.15<\/p><p>Fixed in version 2.5 <\/p>","date":"2024-10-24"},{"id":"88328254df90d1bae971e4bf1aa5e05e15382756","name":"Conditional Fields for Contact Form 7 <= 2.4.15 - Authenticated (Editor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/cf7-conditional-fields\/conditional-fields-for-contact-form-7-2415-authenticated-editor-stored-cross-site-scripting","description":"The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-10-24"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"h","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"5.9","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"5.9","severity":"medium","av":"network","ac":"low","pr":"high","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"bda9dd0cbca4d675942e520f7b0759e57e5d05a79ce963d9367a104929114375","name":"Conditional Fields for Contact Form 7 [cf7-conditional-fields] < 2.7.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.7.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-25863","name":"CVE-2026-25863","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-25863","description":"[en] Conditional Fields for Contact Form 7 WordPress plugin through version 2.7.2 contains an uncontrolled resource consumption vulnerability in the Wpcf7cfMailParser class where the hide_hidden_mail_fields_regex_callback() method reads an iteration count directly from user-supplied POST parameters without validation or upper bound enforcement. Unauthenticated attackers can supply an arbitrarily large integer value through the REST API endpoint to cause unbounded loop execution with multiple preg_replace() operations, exhausting server memory and crashing the PHP process.","date":"2026-05-04"},{"id":"EUVD-2026-27083","name":"EUVD-2026-27083","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2026-27083","description":"Conditional Fields for Contact Form 7 WordPress plugin through version 2.6.7 contains an uncontrolled resource consumption vulnerability in the Wpcf7cfMailParser class where the hide_hidden_mail_fields_regex_callback() method reads an iteration count directly from user-supplied POST parameters without validation or upper bound enforcement. Unauthenticated attackers can supply an arbitrarily large integer value through the REST API endpoint to cause unbounded loop execution with multiple preg_replace() operations, exhausting server memory and crashing the PHP process.","date":"2026-05-04"},{"id":"2e729e74e88c64e4bce26e7523d90f6cc3fe457d","name":"Conditional Fields for Contact Form 7 <= 2.7.2 - Unauthenticated Denial of Service","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/773e2c1f-cebb-46b8-a073-98814c274b8f","description":"The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 2.7.2. This makes it possible for unauthenticated attackers to starve the server of resources.","date":"2026-05-04"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"n","a":"h","score":"7.5","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H","score":"7.5","severity":"high","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"none","i":"none","a":"high","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-1284","name":"Improper Validation of Specified Quantity in Input","description":"The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null},"cvss4":{"version":"4.0","vector":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:N\/VI:N\/VA:H\/SC:N\/SI:N\/SA:N","score":"8.7","severity":"high","av":"network","ac":"low","at":"none","pr":"none","ui":"none","vc":"none","vi":"none","va":"high","sc":"none","si":"none","sa":"none"}}}]},"updated":"1789102400"}