Multi Step for Contact Form <= 2.9.1 - Unauthenticated Insecure Direct Object Reference to Form Submission Modification and Deletion via '_cf7mls_db_form_data_id' Parameter
- ID
- WPSEC-2026-3029
- Plugin
- Multi Step for Contact Form 7 (cf7-multi-step)
- Affected
- all versions before 2.9.2
- Remediation
- Update to 2.9.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- Multi Step for Contact Form on WPSec AttackSurface
- Fix released
- Published
Description
The Multi Step for Contact Form 7 plugin for WordPress is vulnerable to Insecure Direct Object Reference via the '_cf7mls_db_form_data_id' parameter of the 'cf7mls/v1/cf7mls_validation' REST route in all versions up to, and including, 2.9.1. This is due to missing validation that the submitted data ID belongs to the current form submission when step data is saved to the Database for Contact Form 7 (cf7-database) integration, and due to the plugin storing any posted field, including '_cf7mls_db_form_data_id' itself, which is later used to choose which submission to delete. This makes it possible for unauthenticated attackers to add arbitrary field entries to stored form submissions belonging to other users, and to cause other stored submissions to be deleted. Exploitation requires the Database for Contact Form 7 plugin to be active and the 'save every step' option to be enabled for a form.
References
- https://wpsec.com/vuln/WPSEC-2026-3029/
- https://plugins.svn.wordpress.org/cf7-multi-step/tags/2.9.2/
- https://wordpress.org/plugins/cf7-multi-step/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS