Recently, an alarming situation have been discovered in the tech world. A vulnerability has been found in Contact Form 7 that allows attackers to upload malicious scripts on several sites, including WordPress.
Although the publishers of Contact Form 7 have taken serious action immediately to fix this issue, but only few versions of Contact Form 7 are updated and rest of them are still going to face serious vulnerability. Some of the common vulnerabilities detected are;
Unrestricted File Upload Vulnerability
As we know it is being used in WordPress plugin, hence an unrestricted file upload vulnerability is found that allows attackers to upload web shell that enables them have control over site and can even tamper with a database.
It is noticeable that Contact Form 7 have called their latest update an “urgent security and maintenance release.”
According to Contact Form 7:
“An unrestricted file upload vulnerability has been found in Contact Form 7 5.3.1 and older versions.
Utilizing this vulnerability, a form submitter can bypass Contact Form 7’s filename sanitization, and upload a file which can be executed as a script file on the host server.”
An additional particular shared by the official WordPress plugin repository for Contact Form 7 against vulnerabilities are;
“Removes control, separator, and other types of special characters from filename to fix the unrestricted file upload vulnerability issue.”
As we know that filename sanitization tool is used to block certain file names and allows only restricted list of file names. In the case of Contact Form 7, there was some issue with its functionality and it created a situation in which unauthorized/dangerous files were automatically allowed.
All sites using Contact Form 7 needs to release update immediately in order to tackle this situation, and if you want to avail protected WordPress Hosting by our well experienced IT Consultants, just give us a call.
