NYSL Spam Protect for Contact Form 7 Path Traversal Vulnerability

A path traversal vulnerability has been identified in the NYSL Spam Protect for Contact Form 7 plugin, specifically in versions through 1.2.9. This vulnerability allows for improper limitation of a pathname, potentially leading to arbitrary file deletion on the affected WordPress site.

Impact

Exploitation of this vulnerability could result in arbitrary file deletion, allowing a malicious actor to remove files from the website. Deleting core files could disrupt the site's functionality.

Remediation

Users of the NYSL Spam Protect for Contact Form 7 plugin should update to version 1.2.10 or later. Patchstack users can enable auto-updates for vulnerable plugins.