CVE-2024-3870: 
WordPress vulnerability analysis and mitigation

The Contact Form 7 Database Addon – CFDB7 plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6.8. The vulnerability exists in the cfdb7_before_send_mail function, which can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, and can result in low confidentiality impact without affecting integrity or availability (Wordfence).

The vulnerability allows unauthorized attackers to access sensitive information, specifically Personally Identifiable Information (PII), from files that users have uploaded through the contact form system (NVD).

The vulnerability can be exploited by unauthenticated attackers, requiring no special privileges or user interaction. The attack vector is network-accessible, making it relatively straightforward to exploit (Wordfence).

Users should update their Contact Form 7 Database Addon – CFDB7 plugin to a version newer than 1.2.6.8 to address this vulnerability (NVD).