CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters to extract sensitive database information or escalate privileges.
Explanation of Vulnerability in Simple Terms
Contact Form Maker versions up to 1.12.20 contain a SQL injection vulnerability in form processing. An attacker with low-level access can inject malicious SQL commands through form input fields, potentially reading or modifying the site database. The vulnerability requires authentication but no user interaction.
What an attacker can do
Read or modify data in the site database by injecting SQL commands through form fields.
Potential impact on your site
Attackers with subscriber or contributor access can extract sensitive data or corrupt form submissions and site content.
Conditions required to exploit
Attacker must have a low-privilege account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
