CVE-2023-1615: SQL Injection
The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and including, 3.1.23. This makes it possible for authenticated attackers of any authorization level to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-1615?
CVE-2023-1615 is a vulnerability in the Ultimate Addons for Contact Form 7 plugin for WordPress that allows SQL Injection attacks.
How severe is CVE-2023-1615?
CVE-2023-1615 has a severity score of 6.5, which is considered high.
What software versions are affected by CVE-2023-1615?
Versions up to and including 3.1.23 of the Ultimate Addons for Contact Form 7 plugin for WordPress are affected by CVE-2023-1615.
How can authenticated attackers exploit CVE-2023-1615?
Authenticated attackers of any authorization level can exploit CVE-2023-1615 by appending additional SQL queries to existing queries using the 'id' parameter.
Are there any references for CVE-2023-1615?
Yes, you can find references for CVE-2023-1615 at the following links: [Link 1](https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/trunk/addons/database/database.php?rev=2897709#L255), [Link 2](https://plugins.trac.wordpress.org/changeset/2901676/), [Link 3](https://wordpress.org/plugins/ultimate-addons-for-contact-form-7/#developers).