CVE-2024-3723

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-3723
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.2 via the wp-content/uploads/advanced-cf7-upload directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via this plugin through a form.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3106700%40advanced-cf7-db&new=3106700%40advanced-cf7-db&sfp_email=&sfph_mail=
https://wordpress.org/plugins/advanced-cf7-db/#developers
https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a1f1a1-4f0a-48b5-80c8-525b69006863?source=cve
https://wordpress.org/plugins/advanced-cf7-db/#developers
https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a1f1a1-4f0a-48b5-80c8-525b69006863?source=cve
Configurations

No configuration.

History

08 Apr 2026, 19:21

Type Values Removed Values Added
CWE CWE-922
References
  • () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3106700%40advanced-cf7-db&new=3106700%40advanced-cf7-db&sfp_email=&sfph_mail= -

21 Nov 2024, 09:30

Type Values Removed Values Added
References () https://wordpress.org/plugins/advanced-cf7-db/#developers - () https://wordpress.org/plugins/advanced-cf7-db/#developers -
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a1f1a1-4f0a-48b5-80c8-525b69006863?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a1f1a1-4f0a-48b5-80c8-525b69006863?source=cve -

11 Jun 2024, 13:54

Type Values Removed Values Added
Summary
  • (es) El complemento Advanced Contact form 7 DB para WordPress es vulnerable a la exposición de información confidencial en todas las versiones hasta la 2.0.2 incluida a través del directorio wp-content/uploads/advanced-cf7-upload. Esto hace posible que atacantes no autenticados extraigan datos confidenciales cargados a través de este complemento a través de un formulario.

11 Jun 2024, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-11 06:15

Updated : 2026-04-08 19:21

NVD link : CVE-2024-3723

Mitre link : CVE-2024-3723

CVE.ORG link : CVE-2024-3723

JSON object : View

Products Affected

No product.

CWE
CWE-922

Insecure Storage of Sensitive Information