Arbitrary PHP Code Execution Vulnerability in Contact Form 7 Email Add-on

CVE-2024-10898

What is CVE-2024-10898?

The Contact Form 7 Email Add On plugin for WordPress is susceptible to a Local File Inclusion vulnerability through the function cf7_email_add_on_add_admin_template(). This vulnerability impacts all versions up to and including version 1.9, allowing authenticated users with Contributor-level access or higher to include and execute arbitrary PHP files residing on the server. Exploitation of this vulnerability could lead to unauthorized code execution, data exfiltration, and bypassing of access controls, particularly in scenarios when PHP files can be uploaded and included by the attacker.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References