Vulnerability Details: Cross-Site Request Forgery (CSRF)/SQL Injection Vulnerability in Entries For WPForms
One of the changelog entries for the version 1.4.1 of Entries For WPForms is “Fix – Possible authenticated SQL injection”. In looking over the changes we found that a number of SQL statements were prepared to prevent SQL injection. As we started looking through those to see if there were any vulnerabilities that existed before that was done, we found that some of those did not have a potential for SQL injection either because they didn’t involve user input or the user input was already being restricted to values that could not lead to SQL injection. We did find though, for example, that one of those could have lead to SQL injection through cross-site request forgery (CSRF).
…