Acme Forms <= 3.2.1: Unauthenticated SQL injection

In plain English

Anyone on the internet, without logging in, can send a specially crafted request to a form on your site and read or change data in your database. That can include customer details and admin accounts.

Am I affected?

Yes, if your site has Acme Forms version 3.2.1 or older installed, even if the plugin is deactivated. Check in WordPress under Plugins > Installed Plugins.

What to do

1
Back up your siteTake a full backup before touching anything.
2
Update to 3.2.2 or laterThe developer released a fix. Update from your dashboard and test your forms.
3
Check for signs of compromiseLook for new admin users and unexpected changes since the advisory date.
4
Not sure? Ask usWe check your site for free and tell you if you were affected.

Technical summary

The plugin does not sufficiently escape a user-supplied parameter before using it in a database query. This lets unauthenticated attackers append SQL to existing queries.

Vulnerability data provided by Wordfence Intelligence. CVE identifiers and descriptions are from the CVE List, copyright The MITRE Corporation. Summaries and recommendations by Safe Hands WP. Sample advisory shown for design.