Wow Forms WordPress Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Wow Forms WordPress plugin, version 2.1. This vulnerability allows unauthenticated attackers to read arbitrary database information by exploiting an unescaped POST parameter. Attackers can inject SQL code through the 'mwpformid' parameter in requests to the admin-ajax.php endpoint, using the 'send_mwp_form' action, to extract sensitive database contents.

Impact

Exploitation of this vulnerability allows attackers to read arbitrary data from the database. Depending on the web server's configuration, it may also be possible to gain read and write access to the filesystem.

Reproduction

To reproduce this vulnerability, send a POST request to 'wp-admin/admin-ajax.php' with the 'action' parameter set to 'send_mwp_form'. Include the 'mwpformid' parameter with a crafted SQL injection payload. The injection can be verified by using a SQL injection testing tool, such as sqlmap, to extract database information.