Information Exposure in WordPress Plugin Allows Unauthorized Data Access
CVE-2024-12250

5.3MEDIUM

Key Information:

Vendor

Wordpress
Vendor
CVE Published:
18 December 2024

What is CVE-2024-12250?

CVE-2024-12250 is a vulnerability identified in the Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress. This critical issue affects all versions up to and including version 2.2. The vulnerability arises from improper access control in the cf7adn-info.php file, allowing unauthenticated attackers to extract sensitive configuration data. The exposed information may facilitate further attacks on the website or its users. It is recommended that users of the affected plugin take immediate action to update to the latest version to mitigate the risk of unauthorized access and potential exploitation.

References

https://plugins.trac.wordpress.org/changeset?sfp_email=&s...
https://www.wordfence.com/threat-intel/vulnerabilities/id...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.