CVE-2024-12184: Cimatti Contact Forms Auth Bypass Vulnerability

CVE-2024-12184 Overview

CVE-2024-12184 affects the Contact Forms by Cimatti plugin for WordPress in all versions up to and including 1.9.4. The vulnerability stems from a missing capability check on the accua_forms_download_submitted_file() function. Unauthenticated attackers can download form submissions uploaded by other users. The flaw is classified as [CWE-862] Missing Authorization and is exploitable over the network without user interaction.

Critical Impact
Unauthenticated remote attackers can retrieve arbitrary files submitted through contact forms, exposing personal data, identity documents, and other sensitive content collected by site operators.

Affected Products

Cimatti WordPress Contact Forms plugin, all versions through 1.9.4
WordPress sites using the plugin's file upload/download functionality
Deployments exposing the accua_forms_download_submitted_file() endpoint

Discovery Timeline

2025-02-01 - CVE-2024-12184 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12184

Vulnerability Analysis

The Contact Forms by Cimatti plugin exposes a file download handler named accua_forms_download_submitted_file(). This handler serves files that end users uploaded via contact form submissions. The function does not verify the caller's WordPress capability or ownership of the requested submission before returning the file.

An unauthenticated attacker can invoke the endpoint directly and iterate through file identifiers to enumerate submitted attachments. Because the plugin is commonly used for contact, application, and support forms, exposed files can include résumés, government-issued identity documents, invoices, and other personally identifiable information (PII). The vulnerability affects confidentiality but does not modify data or degrade availability.

Root Cause

The root cause is a missing authorization check ([CWE-862]). The handler relies solely on request parameters to locate a submitted file and streams it back to the requester. There is no current_user_can() verification, no nonce validation tied to a privileged session, and no check that the caller owns or has permission to view the referenced submission.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker crafts an HTTP request that reaches the plugin's download handler, supplying a file or submission identifier as a query parameter. The server responds with the file contents regardless of the attacker's authentication state. No user interaction, prior credentials, or elevated privileges are required.

Because no verified proof-of-concept has been published, refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-12184

Indicators of Compromise

Repeated anonymous HTTP requests referencing accua_forms_download_submitted_file in the query string or admin-ajax.php action parameter.
Sequential enumeration patterns against form submission or file identifier parameters from a single source IP.
Unexpected 200 OK responses returning application/octet-stream or attachment Content-Disposition headers to unauthenticated clients.

Detection Strategies

Inspect web server access logs for requests invoking the vulnerable action name and correlate with the client's authentication cookies (or absence thereof).
Alert on high-volume file download responses originating from the /wp-content/uploads/ path or plugin-specific submission directory.
Deploy a web application firewall rule that blocks unauthenticated invocations of the plugin's download handler.

Monitoring Recommendations

Continuously monitor WordPress plugin inventories to identify hosts still running Contact Forms by Cimatti 1.9.4 or earlier.
Track outbound file transfer volumes from WordPress hosts and flag deviations from historical baselines.
Feed WordPress and reverse-proxy logs into a centralized analytics platform to detect enumeration behavior across multiple sites.

How to Mitigate CVE-2024-12184

Immediate Actions Required

Update the Contact Forms by Cimatti plugin to the version released after 1.9.4 that includes the capability check fix.
Audit /wp-content/uploads/ and plugin submission directories for previously exfiltrated files based on access log review.
If the plugin is not actively used, deactivate and remove it from the WordPress installation.

Patch Information

The vendor addressed the missing authorization check in the plugin repository. See the WordPress Plugin Changeset 3231363 and the WordPress Plugin Changeset 3232168 for the code changes that introduced the capability verification.

Workarounds

Restrict access to the plugin's download endpoint at the reverse proxy or WAF layer until the update is deployed.
Move sensitive submitted files outside the web root and require authenticated retrieval through a hardened handler.
Notify affected form submitters if log review indicates unauthorized downloads of their data.

bash

# Example WAF rule (nginx) blocking unauthenticated access to the vulnerable action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "accua_forms_download_submitted_file") {
        return 403;
    }
}