1. Home
  2. CVE Database
  3. CVE-2022-0404
MEDIUM · 6.5

CVE-2022-0404

The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to th...

Vulnerability Description

The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7md_dismiss_notice action, allowing any logged in user (with roles as low as Subscriber) to set arbitrary options to true, potentially leading to Denial of Service by breaking the site.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
Material Design For Contact Form 7 ProjectMaterial Design For Contact Form 7<= 2.6.4

Related Weaknesses (CWE)

CWE-862

References

FAQ

What is CVE-2022-0404?

CVE-2022-0404 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to th...

How severe is CVE-2022-0404?

CVE-2022-0404 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-0404?

Check the references section above for vendor advisories and patch information. Affected products include: Material Design For Contact Form 7 Project Material Design For Contact Form 7.