medium5.4Public exploit code
CVE-2021-24247
The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Contact Form Check Tester 1.0.2 - Broken Access Control2022-02-02 · webapps · php
Impact
The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mooveagency | Contact Form Check Tester | through 1.0.2 |