CVE-2018-25347
HighSummary
The WordPress Contact Form Maker plugin version 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters.
Risk Assessment
This vulnerability may lead to the leakage of sensitive database information or privilege escalation, posing a serious threat to the organization's security.
Recommendation
It is recommended to update the plugin to the latest version to mitigate these vulnerabilities and to monitor logs for potential attack attempts.
Original NVD description (English source)
WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters to extract sensitive database information or escalate privileges.