CVE-2024-1069

The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

• CWE-434
• CWE-434
• CWE-434

• https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/includes/plugin-pages.php?rev=3003884#L1213Issue Tracking
• https://plugins.trac.wordpress.org/changeset/3028640/contact-form-entries#file1Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/120313be-9f98-4448-9f5d-a77186a6ff08?source=cvePatch, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/includes/plugin-pages.php?rev=3003884#L1213Issue Tracking
• https://plugins.trac.wordpress.org/changeset/3028640/contact-form-entries#file1Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/120313be-9f98-4448-9f5d-a77186a6ff08?source=cvePatch, Third Party Advisory

Published

Jan 31, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-10684The Kognetiks Chatbot for WordPress plugin for WordPress is …6.1
• CVE-2024-10685The Contact Form 7 Redirect & Thank You Page plugin for Word…6.1
• CVE-2024-10686Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-10687The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecom…9.8
• CVE-2024-10688The Attesa Extra plugin for WordPress is vulnerable to Infor…4.3
• CVE-2024-10689The XLTab – Accordions and Tabs for Elementor Page Builder p…4.3
• CVE-2024-10690The Shortcodes for Elementor plugin for WordPress is vulnera…4.3
• CVE-2024-10691Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-10692The PowerPack Elementor Addons (Free Widgets, Extensions and…4.3
• CVE-2024-10693The SKT Addons for Elementor plugin for WordPress is vulnera…4.3
• CVE-2024-10694Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-10695The Futurio Extra plugin for WordPress is vulnerable to Info…4.3