VulnSocial

CVE-2017-20244Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by exploiting an unescaped POST parameter. Attackers can inject SQL code through the 'mwpformid' parameter in requests to the admin-ajax.php endpoint with the 'send_mwp_form' action to extract sensitive database contents.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-06-09); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-09: 1Mentions · 2026-07-26: 1Patch / Workaround · 2026-07-26: 1Technical Details · 2026-06-09: 1Technical Details · 2026-07-26: 106-0907-26
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-06-091
Disclosure1
2026-07-261
Patch1
Full discourse2 posts
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH SEVERITY: CVE-2017-20244 (CVSS 8.2) Wow Forms WordPress Plugin v2.1 vulnerable to unauthenticated SQL injection via 'mwpformid' parameter. Attackers can extract sensitive database data. Patch immediately if running affected version. #CVE #Vulnerability #PatchNow https://t.co/ry0vQIcv1P

    Post summary

    The post alerts to a high‑severity CVE‑2017‑20244 affecting Wow Forms WordPress Plugin, details an unauthenticated SQL injection via the mwpformid parameter, and urges users to patch immediately.

    0000031
    96 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2017-20244 Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by exploit… https://www.cve.org/CVERecord?id=CVE-2017-20244

    Post summary

    CVE‑2017‑20244 identifies a SQL injection vulnerability in Wow Forms WordPress Plugin v2.1 that enables unauthenticated readers to access arbitrary database contents.

    00000147
    57.6K followersView on X

Explore more

Back to dashboard