blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2023-1615

MEDIUM 6.5 CVSS 3.1
Published
June 9, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@wordfence.com
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and including, 3.1.23. This makes it possible for authenticated attackers of any authorization level to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Affected WordPress components

  • Ultra Addons for Contact Form 7 Plugin · ultimate-addons-for-contact-form-7
    Confirmed match Active
    Version 3.1.23
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • psdtowpservice Ultimate Addons for Contact Form 7 — Version 3.1.23
  • themefic ultimate_addons_for_contact_form_7 — Up to and including 3.1.23

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/trunk/addons/database/database.php?rev=2897709#L255 Patch
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/2901676/ Patch
  • wordpress.org https://wordpress.org/plugins/ultimate-addons-for-contact-form-7/#developers Release Notes
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/817ca119-ddaf-4525-beee-68c4e0aac544?source=cve Third Party Advisory
  • nvd.nist.gov Official NVD record