CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contact Form - WPManageNinja LLC Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms fluentform allows SQL Injection.This issue affects Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: from n/a through 4.3.25.
Explanation of Vulnerability in Simple Terms
Fluent Forms versions up to 4.3.25 contain a SQL injection vulnerability in the plugin's database query handling. An authenticated administrator can craft malicious input to execute arbitrary SQL commands, potentially reading sensitive data or disrupting database operations. Update to a version newer than 4.3.25 to resolve this issue.
What an attacker can do
Read sensitive database records or cause database errors by injecting SQL commands.
Potential impact on your site
An admin account compromise could expose your database contents or cause site instability.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
