Everest Forms <= 1.4.9 is vulnerable to SQL Injection (SQLi) vulnerability

Unauthenticated

Published
2019-07-18

A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/evf-entry-functions.php

CVE

https://www.cve.org/CVERecord?id=CVE-2019-13575

CVSS

Score:9.8

Severity:Critical

Version: 1.4.9

There is a patch available in v1.5.0 and we strongly recommend you update to this version as soon as possible.