WPB Popup for Contact Form 7 – Affichage de la fenêtre contextuelle Contact Form 7 au clic sur un bouton – CF7 Popup <= 1.7.5 - Exécution arbitraire de shortcode non authentifiée via wpb_pcf_fire_contact_form

The arbitrary shortcode execution vulnerability is particularly concerning because it bypasses authentication checks. An attacker can leverage this to inject malicious shortcodes into the website, which could then be executed by the WordPress server. This could lead to a wide range of impacts, including the execution of arbitrary PHP code, the redirection of users to malicious websites, or the theft of sensitive data stored within the WordPress database. The attacker’s ability to execute arbitrary code grants them significant control over the affected website, potentially enabling them to install malware, modify content, or compromise user accounts. The impact is amplified if the website handles sensitive user data or is integrated with other critical systems.

Websites using the WPB Popup for Contact Form 7 plugin, particularly those running older versions (≤1.7.5), are at risk. Shared hosting environments are especially vulnerable, as they often have limited control over plugin updates and security configurations. Websites that rely on the plugin for critical functionality, such as lead generation or customer support, face a higher potential impact if compromised.

• wordpress / composer / npm:

grep -r 'wpb_pcf_fire_contact_form' /var/www/html/wp-content/plugins/wp-popup-for-contact-form7/

• wordpress / composer / npm:

wp plugin list --status=active | grep 'wp-popup-for-contact-form7'

• wordpress / composer / npm:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=wpb_pcf_fire_contact_form&some_malicious_shortcode | head -n 1

1. 2024-11-19Disclosure

   disclosure

1. Réservé2024-11-08
2. Publiée2024-11-19
3. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2024-11038 is to upgrade the WPB Popup for Contact Form 7 plugin to a version higher than 1.7.5. If an immediate upgrade is not possible due to compatibility issues or breaking changes, consider temporarily disabling the plugin. As a short-term workaround, implement a Web Application Firewall (WAF) rule to block requests containing the wpbpcffirecontactform AJAX action. Carefully review any recent changes to the plugin’s configuration or code for suspicious activity. After upgrading, confirm the fix by attempting to trigger the vulnerable AJAX action and verifying that it is properly sanitized and does not execute arbitrary shortcodes.

Installations actives

6KNiche

Note du plugin