PT-2023-17120 · WordPress · Ultimate Addons For Contact Form 7

Etan Imanol Castro Aldrete · Publicado 2023-06-09 · Atualizado 2023-06-16 · CVE-2023-1615

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Ultimate Addons for Contact Form 7 plugin for WordPress versions up to and including 3.1.23

Description The issue allows authenticated attackers of any authorization level to perform SQL Injection via the id parameter. This enables them to append additional SQL queries into existing ones, potentially extracting sensitive information from the database.

Recommendations For versions up to and including 3.1.23, update to a version higher than 3.1.23 to resolve the issue. As a temporary workaround, consider restricting access to the id parameter in affected API endpoints until a patch is available.

Correção

Identificadores relacionados

CVE-2023-1615

Produtos afetados

Ultimate Addons For Contact Form 7

Referências · 6

• https://osv.dev/vulnerability/CVE-2023-1615 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-1615 · Nota de Segurança
• https://wordpress.org/plugins/ultimate-addons-for-contact-form-7/#developers · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/817ca119-ddaf-4525-beee-68c4e0aac544?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/trunk/addons/database/database.php?rev=2897709#L255 · Correção
• https://plugins.trac.wordpress.org/changeset/2901676 · Correção