Cross-Site Request Forgery Vulnerability in Contact Form 7 Style Plugin for WordPress

CVE-2021-4390

Summary

The Contact Form 7 Style plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit Cross-Site Request Forgery. This issue arises from inadequate nonce validation in the manage_wp_posts_be_qe_save_post() function. By crafting a malicious request, attackers can manipulate site configurations if they can deceive an administrator into clicking a specific link. This vulnerability highlights the importance of implementing stringent security measures to prevent unauthorized actions on behalf of unsuspecting users.

References