Arbitrary PHP Code Execution Vulnerability in Contact Form 7 Email Add-on

CVE-2024-10898

Summary

The Contact Form 7 Email Add On plugin for WordPress is susceptible to a Local File Inclusion vulnerability through the function cf7_email_add_on_add_admin_template(). This vulnerability impacts all versions up to and including version 1.9, allowing authenticated users with Contributor-level access or higher to include and execute arbitrary PHP files residing on the server. Exploitation of this vulnerability could lead to unauthorized code execution, data exfiltration, and bypassing of access controls, particularly in scenarios when PHP files can be uploaded and included by the attacker.

References