CVE-2023-1615: SQL Injection
First published: Fri Jun 09 2023(Updated: )
The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and including, 3.1.23. This makes it possible for authenticated attackers of any authorization level to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Themefic Ultimate Addons for Contact Form 7 | <=3.1.23 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/trunk/addons/database/database.php?rev=2897709#L255
- https://plugins.trac.wordpress.org/changeset/2901676/
- https://wordpress.org/plugins/ultimate-addons-for-contact-form-7/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/817ca119-ddaf-4525-beee-68c4e0aac544?source=cve
Frequently Asked Questions
What is CVE-2023-1615?
CVE-2023-1615 is a vulnerability in the Ultimate Addons for Contact Form 7 plugin for WordPress that allows SQL Injection attacks.
How severe is CVE-2023-1615?
CVE-2023-1615 has a severity score of 6.5, which is considered high.
What software versions are affected by CVE-2023-1615?
Versions up to and including 3.1.23 of the Ultimate Addons for Contact Form 7 plugin for WordPress are affected by CVE-2023-1615.
How can authenticated attackers exploit CVE-2023-1615?
Authenticated attackers of any authorization level can exploit CVE-2023-1615 by appending additional SQL queries to existing queries using the 'id' parameter.
Are there any references for CVE-2023-1615?
Yes, you can find references for CVE-2023-1615 at the following links: [Link 1](https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/trunk/addons/database/database.php?rev=2897709#L255), [Link 2](https://plugins.trac.wordpress.org/changeset/2901676/), [Link 3](https://wordpress.org/plugins/ultimate-addons-for-contact-form-7/#developers).
- agent/references
- agent/type
- agent/remedy
- agent/softwarecombine
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/themefic
- canonical/themefic ultimate addons for contact form 7
- version/themefic ultimate addons for contact form 7/3.1.23