CVE-2021-24403

EUVD-2021-11315
The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 68%
Affected Products (NVD)
VendorProductVersion
wpagecontact_projectwpagecontact
𝑥
≤ 1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://codevigilant.com/disclosure/2021/wp-plugin-wpagecontact/
https://wpscan.com/vulnerability/a87040c1-58fc-4bf7-8bfa-0b9712a62ba8
https://codevigilant.com/disclosure/2021/wp-plugin-wpagecontact/
https://wpscan.com/vulnerability/a87040c1-58fc-4bf7-8bfa-0b9712a62ba8