The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI…
Priority MEDIUM 46CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.
Why it matters now
EPSS 0.01779 78th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cformsii_project:cformsii:*:*:*:*:*:wordpress:*:* | before 14.13 | Vulnerable | Cformsii Project |
- cpe:2.3:a:cformsii_project:cformsii:*:*:*:*:*:wordpress:*:* Versions before 14.13 Vulnerable ·Cformsii Project
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-18570
- 2026-10-03 Alias added: GHSA-43g7-vrh8-pwwx
References
More Cformsii Project Cformsii vulnerabilities
- TI-2015-07710 The cforms2 plugin before 14.6.10 for WordPress has SQL injection. CVSS 3.1CRITICAL 9.8
- TI-2019-11353 The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field. CVSS 3.0HIGH 8.8
- TI-2023-10759 WordPress CformsII Plugin <=15.0.4 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
- TI-2017-13732 The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues. CVSS 3.1MEDIUM 6.1
- TI-2014-08255 The cforms2 plugin before 10.5 for WordPress has XSS. CVSS 3.0MEDIUM 6.1
- TI-2014-08254 The cforms2 plugin before 10.2 for WordPress has XSS. CVSS 3.0MEDIUM 6.1
Sources
- CVE-2017-18570 · CVE Program
- CVE-2017-18570 · NVD
- FIRST EPSS
- GHSA-43g7-vrh8-pwwx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences