Wow Forms <= 3.1.3 - Admin+ SQL Injection

Vulnerability

The Wow Forms WordPress plugin through version 3.1.3 fails to sanitize or escape the did GET parameter before using it in a SQL statement within the delete form functionality. The vulnerable code is located in main.php at line 13, where the parameter is directly concatenated into a DELETE query: $wpdb->query("delete from " . $data . " where id=" . $delid);. This allows an authenticated attacker with administrator-level access to inject arbitrary SQL [1][2].

Exploitation

An attacker must have administrator privileges on the WordPress site. The exploit is performed by sending a crafted GET request to /wp-admin/admin.php?page=mwp-forms&info=del&did=. The payload can include time-based blind SQL injection techniques, such as 1 AND (SELECT 9063 FROM (SELECT(SLEEP(5)))YGWC), to extract information or manipulate the database [1]. No additional user interaction is required beyond the attacker's own actions.

Impact

Successful exploitation allows the attacker to execute arbitrary SQL commands on the WordPress database. This can lead to data exfiltration (e.g., user credentials, sensitive information), modification or deletion of database content, and potentially privilege escalation or complete site compromise. The impact is limited to the database layer, but given the attacker already has admin access, the injection can bypass intended restrictions [1][2].

Mitigation

As of the latest references, no official fix has been released for this vulnerability. The plugin was closed on June 18, 2021, and remains unavailable in the WordPress plugin repository [1][2]. Users are strongly advised to remove or disable the Wow Forms plugin immediately and migrate to an alternative form solution. No workaround is available that does not involve code changes.