Wow Forms – create any form with custom style <= 3.1.3 - Authenticated (Admin+) SQL Injection
highThe Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection.
- CVSS:
- 7.2
- Affected:
- up to 3.1.3
- Fix:
- No patched version reported
- Disclosed:
- Oct 7, 2021