CVE-2023-32741 – This SQL injection vulnerability in the WordPre... (How to Fix)

Q: What is the severity of CVE-2023-32741?

CVE-2023-32741 has a CVSS score of 7.2 (HIGH). This SQL injection vulnerability in the WordPress Contact Form to Any API plugin allows attackers to execute arbitrary SQL commands through the contact form. It affects all WordPress sites using vulnerable versions of this plugin, potentially compromising the underlying database.

📋 TL;DR

This SQL injection vulnerability in the WordPress Contact Form to Any API plugin allows attackers to execute arbitrary SQL commands through the contact form. It affects all WordPress sites using vulnerable versions of this plugin, potentially compromising the underlying database.

💻 Affected Systems

Products:

WordPress Contact Form to Any API plugin

Versions: n/a through 1.1.2

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Affects WordPress installations with the vulnerable plugin enabled. No special configuration required.

📦 What is this software?

Contact Form To Any Api by Itpathsolutions

View all CVEs affecting Contact Form To Any Api →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution via database functions.

🟠

Likely Case

Data exfiltration from WordPress database including user credentials, sensitive form submissions, and potentially site takeover.

🟢

If Mitigated

Limited impact with proper input validation and database user privilege restrictions in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Public exploit details available on Packet Storm Security. SQL injection typically requires minimal technical skill to exploit.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.1.3 or later

Vendor Advisory: https://patchstack.com/database/vulnerability/contact-form-to-any-api/wordpress-contact-form-to-any-api-plugin-1-1-2-sql-injection-vulnerability

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find 'Contact Form to Any API'. 4. Click 'Update Now' if available. 5. If no update available, deactivate and delete the plugin immediately.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily disable the Contact Form to Any API plugin until patched

wp plugin deactivate contact-form-to-any-api

Web Application Firewall rule

all

Add SQL injection detection rule to WAF

Add rule to block SQL injection patterns in contact form parameters

🧯 If You Can't Patch

Remove or disable the Contact Form to Any API plugin immediately
Implement strict input validation and parameterized queries for all form submissions

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Contact Form to Any API version. If version is 1.1.2 or earlier, you are vulnerable.

Check Version:

wp plugin get contact-form-to-any-api --field=version

Verify Fix Applied:

Verify plugin version is 1.1.3 or later in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in database logs
Multiple failed login attempts from contact form submissions
Unexpected database errors in WordPress logs

Network Indicators:

SQL injection patterns in POST requests to contact form endpoints
Unusual outbound database connections

SIEM Query:

source="wordpress.log" AND "contact-form-to-any-api" AND ("SQL" OR "database error" OR "syntax error")

📊 Metadata

CVE ID: CVE-2023-32741

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: November 4, 2023

Last Updated: February 13, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-32741, you might also want to check these: