CVE-2015-9234

High

Published: 30/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The cp-contact-form-with-paypal plugin before version 1.1.6 for WordPress has an SQL injection vulnerability via the cp_contactformpp_id parameter in cp_contactformpp.php.

Risk Assessment

An attacker could exploit this vulnerability to gain unauthorized access to the database, potentially leading to data theft or system compromise.

Recommendation

It is recommended to update the plugin to version 1.1.6 or later to mitigate this vulnerability.

Other vulnerabilities in cp-contact-form-with-paypal plugin for WordPress

CVE-2015-9233High
The cp-contact-form-with-paypal plugin before version 1.1.6 for WordPress has a CSRF vulnerability that results in XSS. The issue is related to the files cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php.

Original NVD description (English source)

The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS