CVE-2024-12255

Summary

CVE-2024-12255 is a newly disclosed Information Exposure vulnerability affecting the Accept Stripe Payments plugin for WordPress. Versions up to 2.5 of this popular contact form add-on contain a critical issue with the cf7sa-info.php file, which returns sensitive phpinfo() data when accessed without proper authentication. The exposure of configuration information can be detrimental, as it can be used by unauthorized actors to launch further attacks on vulnerable WordPress sites. It is highly recommended that users update to the latest version of the plugin or consider removing it altogether if it is no longer needed.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.