WordPress FluentForm Plugin <= 4.3.25 is vulnerable to SQL Injection
CVE-2023-24410

9.8CRITICAL

Key Information:

Vendor
Wordpress
Status
Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms
Vendor
CVE Published:
31 October 2023

Summary

An SQL Injection vulnerability in the Fastest Contact Form Plugin for WordPress by WPManageNinja LLC allows attackers to manipulate SQL queries through improperly sanitized input. This vulnerability could potentially lead to unauthorized access to sensitive data within the database, putting user privacy at risk. Affected versions include those up to 4.3.25. It is critical for users of the plugin to apply the latest updates and employ security best practices to mitigate this risk.

Affected Version(s)

Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms <= 4.3.25

References

https://patchstack.com/database/vulnerability/fluentform/...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ravi Dharmawan (Patchstack Alliance)
.