GoZen Forms WordPress Plugin SQL Injection Vulnerability
Vulnerability
A SQL injection vulnerability has been identified in the GoZen Forms plugin for WordPress, affecting all versions through 1.1.5. The issue arises in the dirGZActiveForm() function, where the 'forms-id' parameter is not properly escaped, allowing unauthenticated attackers to inject additional SQL queries. This exploitation could lead to unauthorized access to sensitive information within the database.
Impact
Exploitation of this vulnerability allows for SQL injection, where attackers can manipulate SQL queries to extract sensitive data from the database.
Remediation
No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.