CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blind SQL Injection.This issue affects Views for WPForms: from n/a through <= 3.4.6.
Explanation of Vulnerability in Simple Terms
Views for WPForms versions 3.4.6 and earlier contain a SQL injection vulnerability. An attacker with low-level WordPress user access can craft malicious input to execute arbitrary SQL queries against the site database. This can expose sensitive data including user credentials and site configuration. The vulnerability affects multiple users across the same WordPress installation.
What an attacker can do
Read or modify database contents, including user passwords and site configuration, with a low-privilege WordPress account.
Potential impact on your site
User data, passwords, and site configuration may be exposed or altered by attackers with basic WordPress access.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (subscriber or contributor level or higher).
Key dates
External resources
Related vulnerabilities
