WordPress Plugin Vulnerabilities
Form Maker by 10Web < 1.13.36 - Authenticated SQL Injection
Description
Authenticated (admin+) SQL injection in the Form Maker by 10Web WordPress Plugin 1.13.35 exists via the /wordpress/wp-admin/admin.php?page=blocked_ips_fm&s=1" s parameter.
Edit (WPScanTeam):
- Initial reported version (5.4.1) does not exist, confirmed to be 1.13.35 by researcher
- May 25th, 2020 - details made public in other places
- May 26th, 2020 - Escalated to WP Plugins Team
Proof of Concept
Affects Plugins
Fixed in 1.13.36 References
Classification
Type
SQLI
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Vu Tien Hoa - SunCSR (Sun* Cyber Security Research)
Submitter
Vu Tien Hoa
Submitter website
Submitter twitter
Verified
No
WPVDB ID
Timeline
Publicly Published
2020-05-26 (about 5 years ago)
Added
2020-05-26 (about 5 years ago)
Last Updated
2020-06-05 (about 5 years ago)
WPScan 