WPB Popup for Contact Form 7 – Exibindo a Pop-up do Contact Form 7 ao Clicar em um Botão – CF7 Popup <= 1.7.5 - Execução Arbitrária de Shortcode Não Autenticada via wpb_pcf_fire_contact_form

The arbitrary shortcode execution vulnerability is particularly concerning because it bypasses authentication checks. An attacker can leverage this to inject malicious shortcodes into the website, which could then be executed by the WordPress server. This could lead to a wide range of impacts, including the execution of arbitrary PHP code, the redirection of users to malicious websites, or the theft of sensitive data stored within the WordPress database. The attacker’s ability to execute arbitrary code grants them significant control over the affected website, potentially enabling them to install malware, modify content, or compromise user accounts. The impact is amplified if the website handles sensitive user data or is integrated with other critical systems.

Websites using the WPB Popup for Contact Form 7 plugin, particularly those running older versions (≤1.7.5), are at risk. Shared hosting environments are especially vulnerable, as they often have limited control over plugin updates and security configurations. Websites that rely on the plugin for critical functionality, such as lead generation or customer support, face a higher potential impact if compromised.

• wordpress / composer / npm:

grep -r 'wpb_pcf_fire_contact_form' /var/www/html/wp-content/plugins/wp-popup-for-contact-form7/

• wordpress / composer / npm:

wp plugin list --status=active | grep 'wp-popup-for-contact-form7'

• wordpress / composer / npm:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=wpb_pcf_fire_contact_form&some_malicious_shortcode | head -n 1

1. 2024-11-19Disclosure

   disclosure

1. Reservado2024-11-08
2. Publicada2024-11-19
3. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-11038 is to upgrade the WPB Popup for Contact Form 7 plugin to a version higher than 1.7.5. If an immediate upgrade is not possible due to compatibility issues or breaking changes, consider temporarily disabling the plugin. As a short-term workaround, implement a Web Application Firewall (WAF) rule to block requests containing the wpbpcffirecontactform AJAX action. Carefully review any recent changes to the plugin’s configuration or code for suspicious activity. After upgrading, confirm the fix by attempting to trigger the vulnerable AJAX action and verifying that it is properly sanitized and does not execute arbitrary shortcodes.

Instalações ativas

6KNicho

Avaliação do plugin