Unauthorized Plugin Deactivation Vulnerability in Contact Form 7

CVE-2024-9891

Summary

The Multiline files upload feature of the Contact Form 7 plugin for WordPress is affected by a vulnerability that could allow authenticated attackers with Subscriber-level access or above to deactivate the plugin. This is due to a missing capability check in the mfcf7_zl_custom_handle_deactivation_plugin_form_submission() function, present in all versions up to and including 2.8.1. The lack of proper permission controls could enable unauthorized users to disrupt the functionality of the plugin, leading to potential security risks and site integrity issues.

References