CVE-2024-12341: 
WordPress vulnerability analysis and mitigation

The Custom Skins Contact Form 7 plugin for WordPress contains a vulnerability (CVE-2024-12341) discovered and disclosed on December 11, 2024. The vulnerability affects all versions up to and including 1.0, where a missing capability check on the 'cf7cs_action_callback' function allows unauthorized modification of data (NVD).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 base score of 4.3 (Medium). The attack vector is network-based (AV:N), requires low attack complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), affects only the unchanged scope (S:U), has no impact on confidentiality (C:N), low impact on integrity (I:L), and no impact on availability (A:N) (Wordfence).

The vulnerability allows authenticated attackers with Subscriber-level access and above to update the content of any post and create new skins on the affected WordPress installations (NVD).

The vulnerability can be exploited by authenticated users with minimal privileges (Subscriber-level and above). The attack requires network access but is considered low complexity to execute (NVD).

Website administrators running the Custom Skins Contact Form 7 plugin should update to a version newer than 1.0 if available, or consider implementing additional access controls to restrict unauthorized modifications (NVD).