CVE-2017-15919

Critical

Published: 26/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The ultimate-form-builder-lite plugin before version 1.3.7 for WordPress has SQL Injection, leading to PHP Object Injection via wp-admin/admin-ajax.php.

Risk Assessment

An attacker could exploit this vulnerability to gain access to sensitive data or execute unauthorized code on the server.

Recommendation

It is recommended to update the plugin to version 1.3.7 or later to mitigate this vulnerability.

Original NVD description (English source)

The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin-ajax.php.