CVE-2018-25347 WordPress Contact Form Maker Plugin 1.12.20 SQL Injection
HighCVSS 7.1
EPSS 0.21%
- Published
- Updated
- Exploit status
- No public exploit known
Description
WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters to extract sensitive database information or escalate privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| web-dorado contact form maker | <= 1.12.20 | No fix listed |
References
- ExploitDB-44854 exploit
- Product Reference product
- VulnCheck Advisory: WordPress Contact Form Maker Plugin 1.12.20 SQL Injection third-party-advisory