Start Free Trial
Advertisement
  1. SEJ
  2.  » 
  3. News

Contact Form 7 Vulnerability in +5 Million Sites

A serious vulnerability was patched in Contact Form 7 that allows attackers to upload malicious scripts.

Contact Form 7 Vulnerability in +5 Million Sites
Advertisement

A vulnerability has been discovered in Contact Form 7 that allows an attacker to upload malicious scripts. The publishers of Contact Form 7 have released an update to fix the vulnerability.

Unrestricted File Upload Vulnerability

An unrestricted file upload vulnerability in a WordPress plugin is when the plugin allows an attacker to upload a web shell (malicious script) that can then be used to take over a site, tamper with a database and so on.

A web shell is a malicious script that can be written in any web language that is uploaded to a vulnerable site, automatically processed and used to gain access, execute commands, tamper with the database, etc.

Contact Form 7 calls their latest update an “urgent security and maintenance release.

According to Contact Form 7:

“An unrestricted file upload vulnerability has been found in Contact Form 7 5.3.1 and older versions.

Utilizing this vulnerability, a form submitter can bypass Contact Form 7’s filename sanitization, and upload a file which can be executed as a script file on the host server.”

A more detailed description of the vulnerability was published on Contact Form 7’s WordPress plugin repository page.

These are the additional details about the vulnerability that was shared on the official WordPress plugin repository for Contact Form 7:

“Removes control, separator, and other types of special characters from filename to fix the unrestricted file upload vulnerability issue.”

Screenshot of WordPress Plugin Changelog Update Description

Screenshot of Contact Form 7 Changelog

The screenshot above is of the Contact Form 7 plugin “more info” description that is shown when updating the plugin from a WordPress installation. The wording matches what is published on the official WordPress repository for the plugin.

Advertisement
Continue Reading Below

Filename Sanitization

Filename sanitization is a reference to a function related to scripts that process uploads. Filename sanitization functions are designed to control what kinds of files (file names) are uploaded by restricting certain kinds of files. Filename sanitization also can control file paths.

A filename sanitization function works by blocking certain file names and/or allowing only a restricted list of file names.

In the case of Contact Form 7, there was an issue in the filename sanitization which created the situation where certain kinds of dangerous files were unintentionally allowed.

Vulnerability Fixed in Contact Form 7 Version 7.5.3.2

The vulnerability was originally discovered by researchers at Web Security company Astra.

The filename sanitization vulnerability exploit is fixed in Contact Form 7 version 7 5.3.2.

Advertisement
Continue Reading Below

All versions of Contact Form 7 from 7 5.3.1 and under are considered vulnerable and should be updated immediately.

Citations

Read announcement at Contact Form 7
https://contactform7.com/2020/12/17/contact-form-7-532/

Read announcement at Security Company Astra
Unrestricted File Upload Vulnerability found in Contact Form 7

Read the Contact Form 7 Changelog

ADVERTISEMENT

Subscribe to SEJ

Get our daily newsletter from SEJ's Founder Loren Baker about the latest news in the industry!

Ebook

Roger Montti

Roger Montti is a search marketer with 20 years experience. He provides site audits, phone consultations and content and link ... [Read full bio]

ADVERTISEMENT
Advertisement
Read the Next Article
Read the Next