CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nucleus_genius Quasar form free – Contact Form Builder for WordPress allows SQL Injection.This issue affects Quasar form free – Contact Form Builder for WordPress: from n/a through 6.0.
Explanation of Vulnerability in Simple Terms
The Quasar form free plugin for WordPress contains a SQL injection vulnerability in versions up to 6.0. An authenticated attacker with low privileges can inject malicious SQL code through form inputs, potentially reading sensitive database information. The vulnerability affects the site's database confidentiality and may cause service disruption.
What an attacker can do
Read sensitive data from the WordPress database and cause service disruption.
Potential impact on your site
Attackers with basic WordPress access can extract database contents including user data, posts, and configuration without admin approval.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
