CVE-2023-6449

The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7_antiscript_file_name' function in versions up to, and including, 5.8.3. This makes it possible for authenticated attackers with editor-level capabilities or above to upload arbitrary files on the affected site's server, but due to the htaccess configuration, remote code cannot be executed in most cases. By default, the file will be deleted from the server immediately. However, in some cases, other plugins may make it possible for the file to live on the server longer. This can make remote code execution possible when combined with another vulnerability, such as local file inclusion.

We have discovered 1,881,212 live websites that are affected by CVE-2023-6449.

Test my site



Affected Software

Product  Contact Form 7
Category Form Builders
Vulnerable Domains1,881,212 live websites (44.83% of Contact Form 7 install base)
Vulnerable Versions
  • from 0 through 5.8.3
Vulnerable Versions Count115 versions ( 74.68% of all versions)



Details

  • Published - Dec 1, 2023
  • Updated - Oct 15, 2024

Credits

  • István Márton (finder)

CVE-2023-6449 usage by Country

United States456,111 websites


Germany204,470 websites
Japan195,936 websites
France137,683 websites
Russia77,570 websites
GB67,754 websites
Poland57,397 websites
Italy56,391 websites
Spain53,458 websites
Netherlands53,438 websites

CVE-2023-6449 usage by TLD

.com748,359 websites
.de97,224 websites
.ru65,749 websites
.org60,298 websites
.co.uk50,250 websites
.nl49,750 websites
.net49,539 websites
.fr49,319 websites
.it46,710 websites
.pl46,199 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2023-6449

Top websites that are affected by CVE-2023-6449. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****.br Brazil***
********.com Singapore*,***
************.com United States*,***
*******.org United States*,***
*******************.de Germany*,***
*********.com United States*,***
***************.com United States*,***
*************.com United States*,***
*********.com United States*,***
*****.****.br Brazil*,***
See full domain list

FAQ

A total of 1,881,212 websites have been identified as vulnerable to CVE-2023-6449, discovered through global website indexing conducted by WebTechSurvey.
Contact Form 7 is susceptible to CVE-2023-6449 vulnerability.
Contact Form 7 versions before, and including, 5.8.3 are vulnerable to CVE-2023-6449.