CVE-2024-4870 - Vulnerability Details - OpenCVE

The Frontend Registration – Contact Form 7 plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1 due to insufficient restriction on the '_cf7frr_' post meta. This makes it possible for authenticated attackers, with editor-level access and above, to modify the default user role in the registration form settings.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Wordpress	Wordpress

No data.

No data.

References

Link	Providers
https://plugins.trac.wordpress.org/browser/frontend-registration-contact-form-7/trunk/frontend-registration-cf7.php?rev=2975770#L244
https://www.wordfence.com/threat-intel/vulnerabilities/id/ca616ae6-59d3-4037-b538-d371f007a037?source=cve

History

Sun, 13 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00262}`	epss `{'score': 0.00178}`

Sat, 12 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00215}`	epss `{'score': 0.00262}`

MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-06-04T02:00:54.640Z

Updated: 2024-08-01T20:55:10.245Z

Reserved: 2024-05-14T13:28:23.376Z

Link: CVE-2024-4870

Vulnrichment

Updated: 2024-08-01T20:55:10.245Z

NVD

Status : Awaiting Analysis

Published: 2024-06-04T02:15:49.620

Modified: 2024-11-21T09:43:45.780

Link: CVE-2024-4870

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-4870", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2024-05-14T13:28:23.376Z", "datePublished": "2024-06-04T02:00:54.640Z", "dateUpdated": "2024-08-01T20:55:10.245Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2024-06-04T02:00:54.640Z"}, "affected": [{"vendor": "pokornydavid", "product": "Frontend Registration \u2013 Contact Form 7", "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "5.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Frontend Registration \u2013 Contact Form 7 plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1 due to insufficient restriction on the '_cf7frr_' post meta. This makes it possible for authenticated attackers, with editor-level access and above, to modify the default user role in the registration form settings."}], "title": "Frontend Registration \u2013 Contact Form 7 <= 5.1 - Authenticated (Editor+) Privilege Escalation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca616ae6-59d3-4037-b538-d371f007a037?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/frontend-registration-contact-form-7/trunk/frontend-registration-cf7.php?rev=2975770#L244"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-266 Incorrect Privilege Assignment"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "timeline": [{"time": "2024-05-14T00:00:00.000+00:00", "lang": "en", "value": "Discovered"}, {"time": "2024-06-03T00:00:00.000+00:00", "lang": "en", "value": "Disclosed"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4870", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-04T15:26:02.603792Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:56:14.283Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:55:10.245Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca616ae6-59d3-4037-b538-d371f007a037?source=cve", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/frontend-registration-contact-form-7/trunk/frontend-registration-cf7.php?rev=2975770#L244", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca616ae6-59d3-4037-b538-d371f007a037?source=cve", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/frontend-registration-contact-form-7/trunk/frontend-registration-cf7.php?rev=2975770#L244", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:55:10.245Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4870", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-04T15:26:02.603792Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T15:26:07.578Z"}}], "cna": {"title": "Frontend Registration \u2013 Contact Form 7 <= 5.1 - Authenticated (Editor+) Privilege Escalation", "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "pokornydavid", "product": "Frontend Registration \u2013 Contact Form 7", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "5.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-05-14T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2024-06-03T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca616ae6-59d3-4037-b538-d371f007a037?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/frontend-registration-contact-form-7/trunk/frontend-registration-cf7.php?rev=2975770#L244"}], "descriptions": [{"lang": "en", "value": "The Frontend Registration \u2013 Contact Form 7 plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1 due to insufficient restriction on the '_cf7frr_' post meta. This makes it possible for authenticated attackers, with editor-level access and above, to modify the default user role in the registration form settings."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-266 Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2024-06-04T02:00:54.640Z"}}}, "cveMetadata": {"cveId": "CVE-2024-4870", "state": "PUBLISHED", "dateUpdated": "2024-08-01T20:55:10.245Z", "dateReserved": "2024-05-14T13:28:23.376Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2024-06-04T02:00:54.640Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}