blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-0404

MEDIUM 6.5 CVSS 3.1
Published
April 4, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Description

The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7md_dismiss_notice action, allowing any logged in user (with roles as low as Subscriber) to set arbitrary options to true, potentially leading to Denial of Service by breaking the site.

Affected products and versions

  • Unknown Material Design for Contact Form 7 — Up to and including 2.6.4
  • material_design_for_contact_form_7_project material_design_for_contact_form_7 — Up to and including 2.6.4

References

  • wpscan.com https://wpscan.com/vulnerability/6d0932bb-d515-4432-b67b-16aba34bd285 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record