Information Exposure in WordPress Plugin Allows Unauthorized Data Access

Summary

CVE-2024-12250 is a vulnerability identified in the Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress. This critical issue affects all versions up to and including version 2.2. The vulnerability arises from improper access control in the cf7adn-info.php file, allowing unauthenticated attackers to extract sensitive configuration data. The exposed information may facilitate further attacks on the website or its users. It is recommended that users of the affected plugin take immediate action to update to the latest version to mitigate the risk of unauthorized access and potential exploitation.

References