CVE-2024-12341

Summary

CVE-2024-12341 is a vulnerability affecting the Custom Skins Contact Form 7 plugin for WordPress. This issue arises from a missing capability check within the 'cf7cs_action_callback' function, which is present in all versions up to and including 1.0. Consequently, authenticated attackers, even those with Subscriber-level access or higher, can manipulate post content or create new skins without proper authorization, posing a potential risk to website security.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.