CVE-2024-12250: WordPress Contact Form 7 Plugin Info Leak

CVE-2024-12250 Overview

CVE-2024-12250 is an information exposure vulnerability [CWE-200] in the Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress. The flaw affects all versions up to and including 2.2. Unauthenticated attackers can access the cf7adn-info.php file to extract plugin configuration data. This exposed information can support further attacks against affected WordPress installations.

Critical Impact
Unauthenticated remote attackers can retrieve plugin configuration data over the network without any user interaction, providing reconnaissance value for follow-on attacks.

Affected Products

WordPress plugin: Accept Authorize.NET Payments Using Contact Form 7
Versions 2.2 and earlier
WordPress sites processing payments through the affected plugin

Discovery Timeline

2024-12-18 - CVE-2024-12250 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12250

Vulnerability Analysis

The vulnerability resides in the cf7adn-info.php file bundled with the Accept Authorize.NET Payments Using Contact Form 7 plugin. The file is directly accessible over HTTP and returns plugin configuration data without performing authentication or authorization checks. An unauthenticated attacker only needs to send an HTTP request to the file's URL to retrieve the exposed information.

The disclosed configuration data can include environment details useful for reconnaissance. Attackers use this information to profile the target, identify plugin versions, and plan subsequent attacks such as targeted exploitation of adjacent vulnerabilities or payment-flow abuse.

Root Cause

The root cause is missing access control on a plugin diagnostic or informational endpoint. The cf7adn-info.php script exposes internal configuration output to any requester. There is no capability check, nonce validation, or authentication gate protecting the response.

Attack Vector

Exploitation requires only network access to the WordPress site hosting the vulnerable plugin. The attacker issues a direct HTTP GET request to the plugin path containing cf7adn-info.php. The server responds with configuration data that should not be publicly visible. No credentials, user interaction, or elevated privileges are required.

Because no verified public exploit code has been published, the vulnerability is described in prose. See the Wordfence Vulnerability Analysis and the WordPress Plugin Changeset for technical detail.

Detection Methods for CVE-2024-12250

Indicators of Compromise

Unauthenticated HTTP GET requests to URLs containing cf7adn-info.php under /wp-content/plugins/accept-authorize-net-payments-using-contact-form-7/
Requests from unfamiliar IP ranges enumerating multiple WordPress plugin paths in sequence
HTTP 200 responses to the cf7adn-info.php endpoint originating from external sources

Detection Strategies

Review web server access logs for requests matching the cf7adn-info.php path and flag any response codes other than 403 or 404
Deploy a web application firewall (WAF) rule that blocks direct access to plugin diagnostic files
Correlate reconnaissance requests against plugin files with subsequent authentication or payment-flow anomalies

Monitoring Recommendations

Alert on repeated access attempts to WordPress plugin PHP files from single source IPs
Monitor for outbound follow-on activity after configuration disclosure requests, including probes against payment endpoints
Track plugin inventory across WordPress deployments to identify installations still running version 2.2 or earlier

How to Mitigate CVE-2024-12250

Immediate Actions Required

Update the Accept Authorize.NET Payments Using Contact Form 7 plugin to a version later than 2.2
Audit web server logs for prior access to cf7adn-info.php and treat any successful requests as reconnaissance
Rotate any Authorize.NET credentials or API keys that may have been referenced in the exposed configuration

Patch Information

A fix was committed upstream in the plugin repository. Review the WordPress Plugin Changeset for the specific code changes and upgrade to the patched release available through the WordPress plugin directory.

Workarounds

Block external access to cf7adn-info.php at the web server or WAF layer until the plugin is updated
Restrict access to the plugin directory using .htaccess or equivalent server configuration
Temporarily deactivate the plugin if payment processing can be paused until a patched version is installed

bash

# Example nginx rule to block direct access to the vulnerable file
location ~* /wp-content/plugins/accept-authorize-net-payments-using-contact-form-7/cf7adn-info\.php$ {
    deny all;
    return 403;
}