CVE-2017-20244

HIGH

Wow Forms WordPress Plugin 2.1 SQL Injection

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2017-20244 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit.

Description

Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by exploiting an unescaped POST parameter. Attackers can inject SQL code through the 'mwpformid' parameter in requests to the admin-ajax.php endpoint with the 'send_mwp_form' action to extract sensitive database contents.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 9, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Wow Forms

Browse Wow-Company / Wow Forms
CVE List2.1affected

Proofs of concept

1

Catalogued exploits

ExploitDBWordPress Plugin Wow Forms 2.1 - SQL InjectionExploitDB exploitby TAD GROUPNot analyzed1 file
ExploitDB
PoC details

References

6