CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Database for Contact Form 7, WPforms, Elementor forms contact-form-entries allows SQL Injection.This issue affects Database for Contact Form 7, WPforms, Elementor forms: from n/a through 1.3.0.
Explanation of Vulnerability in Simple Terms
A SQL injection vulnerability in Database for Contact Form 7, WPforms, Elementor forms allows authenticated users with low privileges to read sensitive data from the site's database. The vulnerability exists in versions up to 1.3.0. An attacker can craft malicious input to extract information like user credentials, email addresses, and form submissions. The impact extends beyond the plugin itself due to scope change.
What an attacker can do
Read sensitive data from the site database, including user information and form submissions.
Potential impact on your site
User data, passwords, and form submissions stored in the database can be exposed to authenticated attackers.
Conditions required to exploit
Attacker must be logged in with a low-privilege account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
