WordPress WS Form LITE Plugin <= 1.9.170 is vulnerable to SQL Injection
CVE-2023-52135

7.6HIGH

Key Information:

Vendor
Wordpress
Status
WS Form LITE – Drag & Drop Contact Form Builder for WordPress
Vendor
CVE Published:
29 December 2023

Summary

A vulnerability exists in WS Form LITE, a popular drag-and-drop contact form builder for WordPress, due to improper neutralization of special elements utilized in SQL commands. This issue could allow attackers to execute malicious SQL injection attacks, potentially compromising the database and extracting sensitive information. Users of WS Form LITE versions up to 1.9.170 are encouraged to apply the necessary updates to mitigate this risk.

Affected Version(s)

WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.170

References

https://patchstack.com/database/vulnerability/ws-form/wor...
vdb-entry

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Daffa (Patchstack Alliance)
.