CVE-2021-24777

Name of the Vulnerable Software and Affected Versions Hotscot Contact Form WordPress plugin versions prior to 1.3

Description The issue concerns the view submission functionality in the plugin, which makes a GET request with the sub id parameter. This parameter is not sanitized, escaped, or validated before being inserted into a SQL statement, leading to an SQL injection.

Recommendations For versions prior to 1.3, update to version 1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the view submission functionality to minimize the risk of exploitation. Avoid using the sub id parameter in the affected API endpoint until the issue is resolved.