Platform
wordpress
Component
country-state-city-auto-dropdown
Fixed in
2.7.3
A critical SQL Injection vulnerability (CVE-2024-3495) has been identified in the Country State City Dropdown CF7 plugin for WordPress. This flaw allows unauthenticated attackers to inject malicious SQL queries, potentially leading to unauthorized access and data exfiltration. The vulnerability affects versions up to and including 2.7.2. A patch is available; users are strongly advised to upgrade immediately.
The SQL Injection vulnerability in Country State City Dropdown CF7 allows attackers to manipulate database queries directly. Successful exploitation could enable attackers to extract sensitive information such as user credentials, customer data, or other confidential information stored within the WordPress database. Depending on the database schema and permissions, an attacker might even be able to modify or delete data, leading to significant operational disruption and data loss. This vulnerability is particularly concerning given the plugin's popularity and the potential for widespread compromise across WordPress sites.
CVE-2024-3495 was publicly disclosed on May 22, 2024. While no active exploitation campaigns have been definitively confirmed, the vulnerability's critical severity and ease of exploitation make it a high-priority target. Public proof-of-concept exploits are likely to emerge, increasing the risk of widespread attacks. This vulnerability is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
93.39% (100% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-3495 is to upgrade the Country State City Dropdown CF7 plugin to a version that includes the security fix. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to filter out malicious SQL injection attempts targeting the ‘cnt’ and ‘sid’ parameters. Additionally, review and restrict database user permissions to limit the potential impact of a successful attack. Monitor WordPress access logs for suspicious SQL queries.
Update the Country State City Dropdown CF7 plugin to the latest available version. The most recent version includes a fix for the (SQL Injection) vulnerability, preventing unauthorized access to the database.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-3495 is a critical SQL Injection vulnerability affecting the Country State City Dropdown CF7 plugin for WordPress versions up to 2.7.2, allowing attackers to extract data from the database.
You are affected if you are using the Country State City Dropdown CF7 plugin in WordPress and are running version 2.7.2 or earlier. Upgrade immediately.
Upgrade the Country State City Dropdown CF7 plugin to the latest available version that includes the security fix. Consider a WAF as a temporary mitigation.
While no active exploitation campaigns have been confirmed, the vulnerability's severity makes it a likely target. Monitor your systems closely.
Check the plugin developer's website or the WordPress plugin repository for the latest advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.