CVE-2021-24282

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7r_reset_settings to reset the plugin’s settings, wpcf7r_add_action to add actions to a form, and more.

• CWE-863

• https://wpscan.com/vulnerability/def87e69-bade-431b-b101-d463a26406e9Exploit, Vendor Advisory
• https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/Exploit, Vendor Advisory
• https://wpscan.com/vulnerability/def87e69-bade-431b-b101-d463a26406e9Exploit, Vendor Advisory
• https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/Exploit, Vendor Advisory

Published

May 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24277The RSS for Yandex Turbo WordPress plugin before 1.30 did no…5.4
• CVE-2021-24278In the Redirection for Contact Form 7 WordPress plugin befor…7.5
• CVE-2021-24279In the Redirection for Contact Form 7 WordPress plugin befor…6.5
• CVE-2021-2428Vulnerability in the Oracle Coherence product of Oracle Fusi…8.1
• CVE-2021-24280In the Redirection for Contact Form 7 WordPress plugin befor…8.8
• CVE-2021-24281In the Redirection for Contact Form 7 WordPress plugin befor…4.3
• CVE-2021-24283The tab GET parameter of the settings page is not sanitised …5.4
• CVE-2021-24284The Kaswara Modern VC Addons WordPress plugin through 3.0.1 …9.8
• CVE-2021-24285The request_list_request AJAX call of the Car Seller - Auto …9.8
• CVE-2021-24286The settings page of the Redirect 404 to parent WordPress pl…6.1
• CVE-2021-24287The settings page of the Select All Categories and Taxonomie…6.1
• CVE-2021-24288When subscribing using AcyMailing, the 'redirect' parameter …6.1