CVE-2021-24628: Wow Forms <= 3.1.3 - Admin+ SQL Injection
Published Nov 8, 2021
·Updated
The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection
Affected Software
1 affected component
Wow-Company Wow Forms Wordpress<=3.1.3
Event History
Nov 8, 2021
CVE Published
via MITRE·05:34 PM
Data Sourced
via MITRE·05:34 PM
DescriptionWeakness
Frequently Asked Questions
1
What is CVE-2021-24628?
CVE-2021-24628 is a vulnerability in the Wow Forms WordPress plugin that allows for authenticated SQL injection.
2
What is the severity of CVE-2021-24628?
CVE-2021-24628 has a severity rating of 7.2 (High).
3
How does CVE-2021-24628 affect Wow Forms?
CVE-2021-24628 affects Wow Forms versions up to and including 3.1.3.
4
How can CVE-2021-24628 be exploited?
CVE-2021-24628 can be exploited by an authenticated user through the 'did' GET parameter in a SQL statement when deleting a form in the admin dashboard.
5
What is the Common Weakness Enumeration (CWE) associated with CVE-2021-24628?
CVE-2021-24628 is associated with CWE-89, which is Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').