CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
WordPress Ultimate Form Builder Lite plugin version 1.3.7 and below contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the entry_id POST parameter. Attackers can send POST requests to the admin-ajax.php endpoint with the ufbl_get_entry_detail_action action to extract, modify, or escalate privileges within the WordPress database.
Explanation of Vulnerability in Simple Terms
Ultimate Form Builder Lite versions 1.3.7 and earlier contain a SQL injection vulnerability in form processing. An attacker with low-level user access can inject malicious SQL commands through form input fields, potentially reading or modifying the site database. The vulnerability requires authentication but no user interaction beyond submitting a crafted form.
What an attacker can do
Read or modify database contents by injecting SQL commands through form fields.
Potential impact on your site
Database contents could be exposed or altered by authenticated attackers; user data and site configuration at risk.
Conditions required to exploit
Attacker must have low-level user account access to the site.
Key dates
External resources
Related vulnerabilities
