CVE-2021-24280
📋 TL;DR
This vulnerability in the Redirection for Contact Form 7 WordPress plugin allows any authenticated user (even low-privileged subscribers) to execute PHP object injection via the import_from_debug AJAX action. This can lead to remote code execution, affecting all WordPress sites running vulnerable versions of this plugin.
💻 Affected Systems
- Redirection for Contact Form 7 WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full site compromise leading to complete administrative control, data theft, malware installation, or site defacement.
Likely Case
Unauthorized code execution leading to backdoor installation, data exfiltration, or privilege escalation.
If Mitigated
Limited impact if proper authentication controls and input validation are in place, but still significant risk.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. Public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.4
Vendor Advisory: https://wordpress.org/plugins/wpcf7-redirect/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Redirection for Contact Form 7'. 4. Click 'Update Now' if available, or manually update to version 2.3.4 or later.
🔧 Temporary Workarounds
Disable vulnerable AJAX endpoint
allRemove or restrict access to the vulnerable import_from_debug AJAX action
Add to theme's functions.php or custom plugin: remove_action('wp_ajax_import_from_debug', 'import_from_debug_callback');
Restrict plugin access
linuxTemporarily disable the plugin until patched
wp plugin deactivate wpcf7-redirect
🧯 If You Can't Patch
- Remove the plugin entirely if not essential
- Implement strict access controls and monitor for suspicious AJAX requests to import_from_debug
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Redirection for Contact Form 7 → Version numberCheck Version:
wp plugin get wpcf7-redirect --field=versionVerify Fix Applied:
Confirm plugin version is 2.3.4 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=import_from_debug
- Unusual PHP execution errors or warnings
Network Indicators:
- HTTP POST requests containing serialized PHP objects to admin-ajax.php
SIEM Query:
source="web_access_logs" AND uri="/wp-admin/admin-ajax.php" AND post_data="*action=import_from_debug*"🔗 References
- https://wpscan.com/vulnerability/db4ba6b0-887e-4ec1-8935-ab21d369b329
- https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/
- https://wpscan.com/vulnerability/db4ba6b0-887e-4ec1-8935-ab21d369b329
- https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/
