WordPress Contact Form CFDB7 SQL Injection Vulnerability Leading to Insecure Deserialization

A pre-authentication SQL injection vulnerability has been identified in the WordPress plugin Contact Form CFDB7, affecting versions through 1.3.2. This vulnerability arises from inadequate validation of user input in plugin endpoints, allowing crafted data to manipulate backend SQL queries. Exploitation of this SQL injection can escalate into insecure deserialization, enabling arbitrary object injection in PHP. The vulnerability is remotely exploitable without authentication, but requires a specific interaction with the affected endpoint to trigger.

Impact

Exploitation of this vulnerability could allow an unauthenticated attacker to access and exfiltrate sensitive database information, modify or corrupt records, and potentially execute remote code on the host, especially in environments with common PHP object injection gadget chains.

Remediation

Users can update to WordPress CFDB7 plugin version 1.3.3 to address this vulnerability.