CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a through 1.7.0.
Explanation of Vulnerability in Simple Terms
The Contact Form to DB plugin for WordPress versions up to 1.7.0 contains a SQL injection vulnerability in its database query handling. An authenticated user with low privileges can craft malicious input to execute arbitrary SQL commands, potentially reading sensitive data from the WordPress database. The vulnerability affects the plugin's core message storage functionality.
What an attacker can do
Read sensitive data from the WordPress database, including user information and private messages.
Potential impact on your site
Unauthorized access to contact form submissions, user data, and other database contents stored by the plugin.
Conditions required to exploit
Attacker must have a WordPress user account with at least subscriber-level access.
Key dates
External resources
Related vulnerabilities
