WordPress Plugin Vulnerabilities

Custom Contact Forms < 5.1.0.4 - Unauthenticated Database Import/Export

Description

The Custom Contact Forms WordPress plugin was vulnerable to a critical vulnerability that allowed an attacker to download and modify the database remotely without authentication.

Affects Plugins

Plugin icon
custom-contact-forms
Fixed in 5.1.0.4

References

URL
https://blog.sucuri.net/2014/08/database-takeover-in-custom-contact-forms.html

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
9.8 (critical)

Miscellaneous

Verified
Yes
WPVDB ID
d1986540-1161-4972-9fae-76c07546a21a

Timeline

Publicly Published
2014-09-17 (about 9 years ago)
Added
2014-09-17 (about 9 years ago)
Last Updated
2020-09-30 (about 3 years ago)

Other

Published
Title
Published
2023-05-22
Title
MStore API < 3.9.2 - Authentication Bypass
Published
2021-08-24
Title
Booster for WooCommerce < 5.4.4 - Authentication Bypass
Published
2023-05-24
Title
MStore API < 3.9.3 - Authentication Bypass
Published
2014-08-01
Title
Profile Builder < 1.1.60 - Password Recovery Bypass
Published
2021-07-21
Title
SendGrid <= 1.11.8 - Authenticated Authorization Bypass