CVE-2021-24905 — Advanced Contact form 7 DB < 1.8.7 - Subscriber+ Arbitrary File Deletion
The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate t…
Published: 2022-03-21 · CVSS: Unscored
The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate the file to be deleted, allowing any authenticated user to delete arbitrary files on the web server. For example, removing the wp-config.php allows attackers to trigger WordPress setup again, gain administrator privileges and execute arbitrary code or display arbitrary content to the users.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7