CVE-2024-5804

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.13. This is due to missing or incorrect nonce validation on the wpcf7cf_admin_init function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jul 20, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-580409.1Crypt::RandomEncryption for Perl version 0.01 uses insecure rand() function during encryption.CVE-2024-580419.1Smolder versions through 1.51 for Perl uses insecure rand() function for cryptographic functions. Smolder 1.51 and earlier for Perl uses thCVE-2024-580425.5In the Linux kernel, the following vulnerability has been resolved: rhashtable: Fix potential deadlock by moving schedule_work outside lockCVE-2024-580435.5Permission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service confidentialitCVE-2024-580445.5Permission verification bypass vulnerability in the notification module Impact: Successful exploitation of this vulnerability may affect avaCVE-2024-580454.7Multi-concurrency vulnerability in the media digital copyright protection module Impact: Successful exploitation of this vulnerability may aCVE-2024-580465.5Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confiCVE-2024-580475.5Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service cCVE-2024-580484.7Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availabCVE-2024-580495.5Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service cCVE-2024-58059.1Improper Authentication vulnerability in Progress MOVEit Gateway (SFTP modules) allows Authentication Bypass.This issue affects MOVEit GatewCVE-2024-580505.5Vulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may affect service confi
CVE-2024-5804: Medium severity, CVSS 4.3 | Vulnix