Skip to content
Sign in
Not rated

CVE-2023-2592 The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL…

Description

The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

Affected products and versions

Product Affected versions Fixed in
FormCraft 3.8 3.8.2 → < 3.9.7 3.9.7

Other CVEs of FormCraft

The 3 CVEs of FormCraft →
CVE-2023-3501 The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high… 4.8 Medium CVE-2022-0591 The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action,… Not rated
Track this CVE