Executive brief
Wow Forms is a WordPress plugin used to create and manage custom website forms. A security flaw in version 2.1 allows unauthorized individuals to access the website's underlying database without needing a password. This could lead to the theft of sensitive information, including user credentials, customer data, and site configuration details.
Technical details
An SQL injection vulnerability exists in the Wow Forms WordPress plugin (version 2.1 and below) due to improper neutralization of the 'mwpformid' POST parameter. The flaw is located within the 'send_mwp_form' action handled by the 'admin-ajax.php' endpoint. An unauthenticated remote attacker can exploit this by sending specially crafted AJAX requests to execute arbitrary SQL commands. This allows for the extraction of sensitive data from the WordPress database via boolean-based blind, time-based blind, or UNION-based techniques. The plugin was closed on the WordPress repository in June 2021 due to security issues.
Affected products
- Wow-Company Wow Forms 2.1 and earlier
Timeline
- 2017-03-15: disclosed: Vulnerability discovered and developer informed
- 2017-03-29: advisory: Public advisory and exploit released by TAD GROUP
- 2021-06-18: other: Plugin closed on WordPress.org repository due to security issues
- 2026-06-09: advisory: CVE published to NVD