SQL Injection Vulnerability in Contact Form 7 Admin Side Data Storage

CVE-2024-1776

What is CVE-2024-1776?

The Contact Form 7 plugin for WordPress contains a vulnerability in its Admin side data storage mechanism, specifically affecting the handling of the 'form-id' parameter. This weakness stems from inadequate escaping of user-supplied input and a lack of sufficient SQL query preparation. As a result, authenticated attackers with administrator-level access can exploit this flaw by injecting arbitrary SQL queries into existing queries. This enables them to extract sensitive data from the database, potentially compromising user information and overall site integrity.

References