PT-2019-13434 · Wpeverest+1 · Everest Forms+1

Published 2019-07-18 · Updated 2023-02-27 · CVE-2019-13575

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPEverest Everest Forms plugin for WordPress versions through 1.4.9

Description A SQL injection issue exists, allowing a remote attacker to execute arbitrary SQL commands on the affected system via includes/evf-entry-functions.php. This could be achieved by exploiting the vulnerability in the WPEverest Everest Forms plugin for WordPress.

Recommendations For versions through 1.4.9, update to a version later than 1.4.9 to resolve the issue. As a temporary workaround, consider restricting access to the includes/evf-entry-functions.php file until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-13575

Affected Products

Everest Forms

Wordpress

References · 8

• https://github.com/wpeverest/everest-forms/commit/755d095fe0d9a756a13800d1513cf98219e4a3f9#diff-bb2b21ef7774df8687ff02b0284505c6 · Patch
• https://github.com/wpeverest/everest-forms/commit/755d095fe0d9a756a13800d1513cf98219e4a3f9 · Patch
• https://osv.dev/vulnerability/CVE-2019-13575 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13575 · Security Note
• https://fortiguard.com/zeroday/FG-VD-19-096 · Note
• https://t.me/cvenotify/45084 · Telegram Post
• https://wpvulndb.com/vulnerabilities/9466 · Note
• https://wordpress.org/plugins/everest-forms/#developers · Note