CVE-2021-24125

CVE-2021-24125: Contact Form Submissions < 1.7.1 - Authenticated SQL Injection

Vendor Unknown
Product Contact Form Submissions
Weakness CWE-89 · SQLi
Published March 18, 2021
Last update August 3, 2024

CVSS base score

What the vulnerability does

01Description

Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7_contact_form GET parameter when submitting a filter request as a high privilege user (admin+)

Key dates

02Disclosure timeline

March 18, 2021 CVE published
August 3, 2024 Record updated