CVE-2021-24790 : What You Need to Know

A vulnerability has been identified in the Contact Form Advanced Database WordPress plugin version 1.0.8 and earlier. This CVE allows any authenticated user, even with a low role like subscriber, to perform unauthorised actions through AJAX calls, leading to potential PHP Object Injection and arbitrary metadata deletion.

Understanding CVE-2021-24790

This CVE details the lack of authorization and CSRF checks in specific AJAX actions of the Contact Form Advanced Database plugin, potentially exploited by authenticated users with minimal access.

What is CVE-2021-24790?

The Contact Form Advanced Database WordPress plugin version 1.0.8 and below lacks proper authorization and CSRF validation, enabling low-privileged users to invoke sensitive AJAX actions.

The Impact of CVE-2021-24790

Exploitation of this vulnerability could result in unauthorized deletion of arbitrary metadata and even PHP Object Injection, especially if a suitable gadget chain exists in other plugins.

Technical Details of CVE-2021-24790

This section outlines the specific technical aspects related to the Contact Form Advanced Database vulnerability.

Vulnerability Description

The issue stems from inadequate authorization and CSRF checks in the delete_cf7_data and export_cf7_data AJAX actions, allowing users with minimal roles to trigger these actions.

Affected Systems and Versions

Contact Form Advanced Database plugin versions up to and including 1.0.8 are impacted by this vulnerability.

Exploitation Mechanism

Exploiting this CVE involves leveraging the lack of proper authorization and CSRF protection in the plugin's AJAX actions to carry out unauthorized operations.

Mitigation and Prevention

To mitigate the risks associated with CVE-2021-24790, immediate actions and long-term security measures are essential.

Immediate Steps to Take

Update the Contact Form Advanced Database plugin to the latest version to patch the vulnerability.
Monitor user roles and access privileges within the WordPress environment.

Long-Term Security Practices

Regularly audit and review third-party plugins for security vulnerabilities.
Educate users on best practices for handling sensitive data and permissions.

Patching and Updates

Stay informed about security updates for the Contact Form Advanced Database plugin and promptly apply patches to ensure system security.