Login Sign Up

CVE-2023-1615

8.8 HIGH
SQL Injection

📋 TL;DR

This SQL injection vulnerability in the Ultimate Addons for Contact Form 7 WordPress plugin allows authenticated attackers of any privilege level to inject malicious SQL queries via the 'id' parameter. This can lead to unauthorized data extraction from the WordPress database. All WordPress sites using vulnerable plugin versions are affected.

💻 Affected Systems

Products:
  • Ultimate Addons for Contact Form 7 WordPress plugin
Versions: Up to and including version 3.1.23
Operating Systems: All operating systems running WordPress
Default Config Vulnerable: ⚠️ Yes
Notes: Requires WordPress installation with the vulnerable plugin enabled. Any authenticated user can exploit this vulnerability.

📦 What is this software?

Ultimate Addons For Contact Form 7 by Themefic

View all CVEs affecting Ultimate Addons For Contact Form 7 →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including extraction of sensitive user data, admin credentials, and potential privilege escalation leading to full site takeover.

🟠

Likely Case

Unauthorized access to sensitive information stored in the database such as user emails, contact form submissions, and potentially hashed passwords.

🟢

If Mitigated

Limited impact with proper input validation and parameterized queries preventing successful injection attempts.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploitation requires authenticated access but any user role can trigger the vulnerability. SQL injection via the 'id' parameter is well-documented.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.1.24 and later

Vendor Advisory: https://wordpress.org/plugins/ultimate-addons-for-contact-form-7/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Ultimate Addons for Contact Form 7'. 4. Click 'Update Now' if available. 5. Alternatively, download version 3.1.24+ from WordPress.org and manually update.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily disable the Ultimate Addons for Contact Form 7 plugin until patched

wp plugin deactivate ultimate-addons-for-contact-form-7

Web Application Firewall rule

linux

Block SQL injection attempts targeting the 'id' parameter

ModSecurity rule: SecRule ARGS:id "@detectSQLi" "id:1001,phase:2,deny,status:403"

🧯 If You Can't Patch

  • Implement strict input validation for all 'id' parameters in custom code
  • Deploy a web application firewall with SQL injection protection rules

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Ultimate Addons for Contact Form 7 > Version number

Check Version:

wp plugin get ultimate-addons-for-contact-form-7 --field=version

Verify Fix Applied:

Verify plugin version is 3.1.24 or higher in WordPress admin

📡 Detection & Monitoring

Log Indicators:

  • Unusual SQL queries in WordPress debug logs
  • Multiple failed login attempts followed by database queries
  • HTTP requests with SQL injection patterns in 'id' parameter

Network Indicators:

  • POST requests to wp-admin/admin-ajax.php with SQL payloads in parameters
  • Unusual database connection patterns from web server

SIEM Query:

source="wordpress.log" AND ("SELECT" OR "UNION" OR "information_schema") AND "id="

📊 Metadata

CVE ID: CVE-2023-1615
CVSS v3 Score: 8.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: June 9, 2023
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON