Executive brief
The Ultimate Form Builder Lite plugin for WordPress, which is used to create and manage website forms, contains a security flaw. An authenticated user with low-level access can manipulate the website's database to steal sensitive information, modify data, or gain higher administrative privileges. This could lead to a full takeover of the website or unauthorized access to customer information stored in the database.
Technical details
An SQL injection vulnerability exists in the WordPress Ultimate Form Builder Lite plugin (version 1.3.7 and earlier) due to improper neutralization of the 'entry_id' POST parameter. The flaw is located within the 'ufbl_get_entry_detail_action' action handled by the 'admin-ajax.php' endpoint, specifically involving the '$wpdb->get_row()' function. An authenticated attacker with at least low-level privileges can send a crafted POST request to execute arbitrary SQL commands. This allows for the extraction of sensitive database contents, modification of records, or privilege escalation. The vulnerability was publicly disclosed in 2018, and users should ensure they have updated to a version beyond 1.3.7.
Affected products
- WordPress Ultimate Form Builder Lite 1.3.7 and below
Timeline
- 2018-06-01: other: Vulnerability discovered
- 2018-06-06: other: Vendor contacted
- 2018-06-12: disclosed: Public advisory released
- 2026-05-23: advisory: NVD/VulnCheck advisory published