CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nasirahmed Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms.This issue affects Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms: from n/a through 1.75.0.
Explanation of Vulnerability in Simple Terms
Advanced Form Integration for WordPress contains a SQL injection vulnerability in versions up to 1.75.0. An authenticated administrator can inject malicious SQL through the plugin's form processing logic, potentially reading sensitive database records. The vulnerability requires high-level privileges and does not affect data integrity or confidentiality of other users' information directly.
What an attacker can do
Read sensitive data from the site's database by injecting SQL commands through plugin forms.
Potential impact on your site
An admin account compromise could expose your database contents, including user data and configuration secrets.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
