CVE-2017-20244

Name of the Vulnerable Software and Affected Versions Wow Forms WordPress Plugin version 2.1

Description An SQL injection allows unauthenticated attackers to read arbitrary database information by exploiting an unescaped POST parameter. Attackers can inject SQL code through the mwpformid parameter in requests to the 'admin-ajax.php' endpoint using the 'send mwp form' action to extract sensitive database contents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.