CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in penguinarts Contact Form 7 Database – CFDB7 advanced-cf7-database allows SQL Injection.This issue affects Contact Form 7 Database – CFDB7: from n/a through <= 1.0.0.
Explanation of Vulnerability in Simple Terms
Contact Form 7 Database (CFDB7) versions up to 1.0.0 contain a SQL injection vulnerability in database query handling. An authenticated administrator can inject malicious SQL commands through unfiltered input, potentially reading sensitive data from the database. The vulnerability requires high-level privileges to exploit but can affect the entire site's data confidentiality.
What an attacker can do
Read sensitive data from the site's database by injecting SQL commands.
Potential impact on your site
An admin account compromise could expose all database contents, including user data and configuration secrets.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
