title: WordPress Page Contact <= 1.0 - Authenticated (editor+) SQL Injection
description: The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors
problem types: CWE-89 SQL Injection
affected:
{
product: WordPress Page Contact
vendor: Unknown
versions:
lessThanOrEqual: 1.0, status: affected, version: 1.0, versionType: custom
}