CVE-2019-17072
📋 TL;DR
This vulnerability allows SQL injection attacks through the all-query-page.php file in the WordPress Contact Form Widget plugin. Attackers can execute arbitrary SQL commands, potentially compromising the entire WordPress database. All WordPress sites using version 1.0.9 of this plugin are affected.
💻 Affected Systems
- WordPress Contact Form Widget (new-contact-form-widget)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, remote code execution, and full site takeover.
Likely Case
Database information disclosure, user data theft, and potential administrative access to WordPress.
If Mitigated
Limited impact with proper input validation and database permissions, but still significant risk.
🎯 Exploit Status
Public proof-of-concept code exists, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.0 or later
Vendor Advisory: https://wordpress.org/plugins/new-contact-form-widget/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Contact Form Widget - Contact Query, Form Maker'. 4. Click 'Update Now' if available, or delete and install latest version from WordPress repository.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the Contact Form Widget plugin until patched
wp plugin deactivate new-contact-form-widget
Remove vulnerable file
linuxDelete the vulnerable all-query-page.php file
rm /path/to/wp-content/plugins/new-contact-form-widget/all-query-page.php
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns
- Restrict database user permissions to minimum required functionality
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for 'Contact Form Widget - Contact Query, Form Maker' version 1.0.9Check Version:
wp plugin get new-contact-form-widget --field=versionVerify Fix Applied:
Verify plugin version is 1.1.0 or later in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to all-query-page.php with SQL syntax
Network Indicators:
- HTTP requests containing SQL injection payloads targeting all-query-page.php
SIEM Query:
source="web_access" AND uri="*all-query-page.php*" AND (request="*UNION*" OR request="*SELECT*" OR request="*INSERT*" OR request="*DELETE*")