The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.

Published Aug 22, 2019 · Updated Aug 5, 2024 · Assigned by mitre