CVE-2022-0404

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7md_dismiss_notice action, allowing any logged in user (with roles as low as Subscriber) to set arbitrary options to true, potentially leading to Denial of Service by breaking the site.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Apr 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-04054.3Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.CVE-2022-04064.3Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.CVE-2022-04077.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.CVE-2022-04087.8Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.CVE-2022-04097.8Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.CVE-2022-04108.8The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a CVE-2022-04118.8The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a CVE-2022-04129.8The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and e CVE-2022-04137.8Use After Free in GitHub repository vim/vim prior to 8.2.CVE-2022-04144.3Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0.CVE-2022-04158.8Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.CVE-2022-04177.8Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.