CVE-2024-6317

Deeper analysis

The Generate PDF using Contact Form 7 plugin for WordPress, in versions through 4.1.2, contains a Cross-Site Request Forgery vulnerability that permits arbitrary file deletion. The flaw stems from absent nonce validation combined with insufficient checks on file paths inside the wp_cf7_pdf_dashboard_html_page function, allowing an attacker to supply a forged request that removes any file on the server.

An unauthenticated attacker can exploit the issue by crafting a malicious request that deletes critical files such as wp-config.php; successful exploitation requires only that a site administrator be tricked into performing an action such as clicking a link, after which site takeover and remote code execution become possible. The vulnerability carries a CVSS 3.1 score of 8.8.

Public references, including the Wordfence advisory and the plugin’s Trac changeset 3146943, indicate that the issue was addressed by updating the plugin to enforce proper nonce checks and file validation; administrators are therefore advised to upgrade beyond version 4.1.2.

EPSS for the CVE rose from a low baseline to a recorded peak of 0.0833, indicating that exploitation interest increased after disclosure.