CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Code Injection.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.1.
Explanation of Vulnerability in Simple Terms
WPForms Google Sheet Connector versions 4.0.1 and earlier allow authenticated users with low privileges to inject and execute arbitrary code on the site. The vulnerability affects the entire system due to scope change. An attacker can read sensitive data, modify site content, or disrupt service availability.
What an attacker can do
Run arbitrary code on the site, read sensitive data, modify content, or disable the site.
Potential impact on your site
Any low-privilege user account can compromise the entire WordPress installation and access all data.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
