PT-2023-17120 · WordPress · Ultimate Addons For Contact Form 7

Etan Imanol Castro Aldrete · Published 2023-06-09 · Updated 2023-06-16 · CVE-2023-1615

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Ultimate Addons for Contact Form 7 plugin for WordPress versions up to and including 3.1.23

Description The issue allows authenticated attackers of any authorization level to perform SQL Injection via the id parameter. This enables them to append additional SQL queries into existing ones, potentially extracting sensitive information from the database.

Recommendations For versions up to and including 3.1.23, update to a version higher than 3.1.23 to resolve the issue. As a temporary workaround, consider restricting access to the id parameter in affected API endpoints until a patch is available.

Fix

Related Identifiers

CVE-2023-1615

Affected Products

Ultimate Addons For Contact Form 7

References · 6

• https://osv.dev/vulnerability/CVE-2023-1615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1615 · Security Note
• https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/trunk/addons/database/database.php?rev=2897709#L255 · Patch
• https://plugins.trac.wordpress.org/changeset/2901676 · Patch
• https://wordpress.org/plugins/ultimate-addons-for-contact-form-7/#developers · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/817ca119-ddaf-4525-beee-68c4e0aac544?source=cve · Note