Contact Form Maker Vulnerabilities

The Contact Form Maker plugin for WordPress is vulnerable to blind SQL Injection in versions before 1.13.23 due to insufficient escaping on a user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with admin-level privileges to append add...

CVSS:

6.6

Affected:

up to 1.13.23

Fix:

No patched version reported

Disclosed:

Jun 15, 2023

CVE-2023-2655 on NVD →

The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.

CVSS:

8.8

Affected:

up to 1.13.5

Fixed in:

1.13.5

Disclosed:

Apr 5, 2019

CVE-2019-11591 on NVD →

The Contact Form Maker plugin for WordPress is vulnerable to blind SQL Injection via the ‘form_id’ parameter in versions before 1.7.31 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with admin-l...

CVSS:

7.2

Affected:

up to 1.7.31

Fixed in:

1.7.31

Disclosed:

Nov 24, 2015

The Contact Form by WD – responsive drag & drop contact form builder tool plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the form_maker_cfm function in versions up to, and including, 1.7.18. This makes it possible for authenticated attackers, with subscriber-level permis...

CVSS:

8.1

Affected:

up to 1.7.18

Fixed in:

1.7.19

Disclosed:

Nov 9, 2014