Description
The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7md_dismiss_notice action, allowing any logged in user (with roles as low as Subscriber) to set arbitrary options to true, potentially leading to Denial of Service by breaking the site.
References (1)
Core 1
Core References
Exploit, Third Party Advisory exploit
vdb-entry
technical-description
https://wpscan.com/vulnerability/6d0932bb-d515-4432-b67b-16aba34bd285
Scores
CVSS v3
6.5
EPSS
0.0104
EPSS Percentile
59.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-862
Status
published
Products (1)
material_design_for_contact_form_7_project/material_design_for_contact_form_7
< 2.6.4
Published
Apr 04, 2022
Tracked Since
Feb 18, 2026