CVE-2022-47586 HIGH

CVE-2022-47586: WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection

Vendor Themefic

Product Ultimate Addons for Contact Form 7

Weakness CWE-89 · SQLi

Published June 19, 2023

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

8.2/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Unauth. SQL Injection (SQLi) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.1.23 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Ultimate Addons for Contact Form 7 versions up to 3.1.23 contain a SQL injection vulnerability in database queries. An attacker can craft a malicious link that, when clicked by a site visitor, executes arbitrary SQL commands. This can expose sensitive data from the WordPress database. The vulnerability requires user interaction and affects the site's confidentiality and availability.

What an attacker can do

03Attacker Capabilities

Execute SQL commands to read or modify database contents, including user data and site configuration.

Potential impact on your site

04Site Impact

Visitor data, user credentials, and other database contents can be exposed or corrupted without your knowledge.

Conditions required to exploit

05Prerequisites

Attacker must trick a site visitor into clicking a malicious link (user interaction required). No authentication needed.

Key dates

06Disclosure timeline

June 19, 2023 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-47586 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities

Identifiers

CVE CVE-2022-47586

CWE CWE-89

CVSS 8.2 / HIGH

Affected versions