CVE-2015-9234 CP Contact Form with PayPal < 1.1.6 - SQL Injection
HighCVSS 7.2
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cfpaypal cp contact form with paypal | <= 1.1.5 | No fix listed |
| wordpress cp-contact-form-with-paypal(WordPress) | < 1.1.6 | 1.1.6 |
References
- seclists.org mailing-list third-party-advisory vdb-entry
- seclists.org mailing-list third-party-advisory
- wordpress.org release-notes third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org