Vulnerability Details CVE-2015-9234
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.012
EPSS Ranking 77.7%
CVSS Severity
CVSS v3 Score 7.2
CVSS v2 Score 6.5
References
- http://seclists.org/fulldisclosure/2015/Jul/49
- http://seclists.org/oss-sec/2015/q3/88
- https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers
- http://seclists.org/fulldisclosure/2015/Jul/49
- http://seclists.org/oss-sec/2015/q3/88
- https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers
Products affected by CVE-2015-9234
-
cpe:2.3:a:cfpaypal:cp_contact_form_with_paypal:*