CVE-2024-10898: Contact Form 7 Email Add On RCE Vulnerability

CVE-2024-10898 Overview

CVE-2024-10898 is a Local File Inclusion (LFI) vulnerability in the Contact Form 7 Email Add On plugin for WordPress, affecting all versions up to and including 1.9. The flaw resides in the cf7_email_add_on_add_admin_template() function, which fails to properly validate file paths before inclusion. Authenticated attackers with Contributor-level access or above can include and execute arbitrary PHP files on the server. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement).

Critical Impact
Authenticated attackers can execute arbitrary PHP code, bypass access controls, and exfiltrate sensitive data from WordPress sites running vulnerable versions of the plugin.

Affected Products

Krishaweb Contact Form 7 Email Add On plugin for WordPress
All versions up to and including 1.9
WordPress sites where Contributor-level or higher accounts exist

Discovery Timeline

2024-11-21 - CVE-2024-10898 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10898

Vulnerability Analysis

The vulnerability exists in the cf7_email_add_on_add_admin_template() function within the plugin's admin template handler. The function accepts user-controllable input and passes it to a PHP include or require statement without sufficient validation or sanitization. This allows attackers to reference PHP files outside of the intended template directory.

An authenticated attacker with at least Contributor privileges can supply a crafted file path parameter to trigger inclusion of arbitrary PHP files residing on the server. Any PHP code within the included file executes in the context of the web server process. Refer to the WordPress plugin source snippet for the affected code location.

Root Cause

The root cause is improper control of a filename used in a PHP include statement, mapped to CWE-98. The cf7_email_add_on_add_admin_template() function does not restrict the file path to an allowlist, does not validate the file extension, and does not enforce a base directory constraint before performing the include operation.

Attack Vector

The attack requires network access to the WordPress admin interface and a valid account with Contributor role or higher. The attacker submits an authenticated request that reaches the vulnerable function with a manipulated template parameter pointing to an arbitrary PHP file on the local filesystem. If the attacker can also upload a PHP file through another mechanism, such as media uploads or a separate flaw, the LFI escalates to full remote code execution. Technical details are available in the Wordfence vulnerability report.

No verified public proof-of-concept code is currently available. See the WordPress changeset for the vendor fix.

Detection Methods for CVE-2024-10898

Indicators of Compromise

Web server access logs containing requests to admin-ajax.php or plugin endpoints with template, file, or path-like parameters referencing ../ sequences or absolute filesystem paths.
Unexpected PHP process activity or outbound connections originating from the WordPress web server after Contributor-level authentication events.
New or modified PHP files in the WordPress uploads directory, particularly files with double extensions or PHP content in non-PHP filenames.
Successful WordPress authentication events for Contributor accounts followed immediately by requests to Contact Form 7 Email Add On endpoints.

Detection Strategies

Monitor HTTP requests to the plugin's admin template handler for parameter values containing directory traversal sequences or references to sensitive files such as wp-config.php.
Deploy web application firewall rules that inspect and block LFI patterns in query strings and POST bodies targeting WordPress plugin routes.
Correlate low-privilege WordPress user sessions with plugin admin activity, since Contributor accounts should not routinely invoke administrative template functions.

Monitoring Recommendations

Enable and centrally aggregate WordPress audit logs covering user role changes, plugin activation, and file modification events.
Alert on PHP file writes into wp-content/uploads/ and any directory reachable by the plugin's include logic.
Track process lineage on the WordPress host to identify web server processes spawning shells or system utilities.

How to Mitigate CVE-2024-10898

Immediate Actions Required

Update the Contact Form 7 Email Add On plugin to a version later than 1.9 that contains the fix referenced in the WordPress changeset 3290456.
Audit all WordPress user accounts and remove or downgrade unnecessary Contributor and higher-privilege accounts.
Review web server and WordPress logs for suspicious requests to the plugin since installation.
Rotate WordPress secrets in wp-config.php and any credentials that may have been exposed if compromise is suspected.

Patch Information

The plugin vendor released a corrected version referenced in WordPress changeset 3290456. Site administrators should apply the update through the WordPress plugin dashboard or by installing the latest release from the WordPress plugin repository. Additional context is available in the Wordfence advisory.

Workarounds

Deactivate and remove the Contact Form 7 Email Add On plugin until patching is complete.
Restrict access to wp-admin by IP allowlist at the web server or WAF layer to reduce the authenticated attack surface.
Enforce the principle of least privilege for WordPress roles and disable self-registration where not required.
Configure PHP open_basedir and disable dangerous functions to constrain what an included file can do on the host.

bash

# Example: restrict PHP file inclusion scope via php.ini
open_basedir = "/var/www/html/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"