CVE-2024-1776

Summary

CVE-2024-1776 is a significant vulnerability in the Contact Form 7 plugin for WordPress. It affects all versions up to and including 1.1.1, allowing authenticated attackers with administrator-level access to inject SQL queries via the 'form-id' parameter. The issue stems from insufficient escaping of user-supplied data and a lack of preparation on existing SQL queries. This vulnerability grants attackers the ability to extract sensitive information from the database, posing a serious risk to WordPress sites using the Contact Form 7 plugin.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.