psonoda

Confirmed fixed in 1.7.3. Thank you! Have a great week.

Did some more digging in my logs found this when active:

[19-Feb-2022 05:26:48 UTC] PHP Fatal error:  Uncaught TypeError: preg_match(): Argument #2 ($subject) must be of type string, array given in /home/DOMAIN/public_html/wp-includes/class-wp-block-parser.php:417
Stack trace:
#0 /home/DOMAIN/public_html/wp-includes/class-wp-block-parser.php(417): preg_match('/<!--\\s+(?P<clo...', Array, NULL, 256, 0)
#1 /home/DOMAIN/public_html/wp-includes/class-wp-block-parser.php(256): WP_Block_Parser->next_token()
#2 /home/DOMAIN/public_html/wp-includes/class-wp-block-parser.php(236): WP_Block_Parser->proceed()
#3 /home/DOMAIN/public_html/wp-includes/blocks.php(890): WP_Block_Parser->parse(Array)
#4 /home/DOMAIN/public_html/wp-includes/blocks.php(623): parse_blocks(Array)
#5 /home/DOMAIN/public_html/wp-includes/formatting.php(5012): filter_block_content(Array, 'post', Array)
#6 /home/DOMAIN/public_html/wp-includes/class-wp-hook.php(303): wp_pre_kses_block_attributes(Array, 'post', Array)
#7 /home/DOMAIN/public_html/wp-includes/plugin.php(189): WP_Hook->apply_filters(Array, Array)
#8 /home/DOMAIN/public_html/wp-includes/kses.php(941): apply_filters('pre_kses', Array, 'post', Array)
#9 /home/DOMAIN/public_html/wp-includes/kses.php(759): wp_kses_hook(Array, 'post', Array)
#10 /home/DOMAIN/public_html/wp-includes/kses.php(2044): wp_kses(Array, 'post')
#11 /home/DOMAIN/public_html/wp-content/plugins/contact-form-submissions/Submissions.php(173): wp_kses_post(Array)
#12 /home/DOMAIN/public_html/wp-content/plugins/contact-form-submissions/Submissions.php(131): WPCF7Submissions->save(Array)
#13 /home/DOMAIN/public_html/wp-includes/class-wp-hook.php(305): WPCF7Submissions->submission(Array, Object(WPCF7_ContactForm))
#14 /home/DOMAIN/public_html/wp-includes/plugin.php(189): WP_Hook->apply_filters(Array, Array)
#15 /home/DOMAIN/public_html/wp-content/plugins/contact-form-7/includes/mail.php(107): apply_filters('wpcf7_mail_comp...', Array, Object(WPCF7_ContactForm), Object(WPCF7_Mail))
#16 /home/DOMAIN/public_html/wp-content/plugins/contact-form-7/includes/mail.php(19): WPCF7_Mail->compose()
#17 /home/DOMAIN/public_html/wp-content/plugins/contact-form-7/includes/submission.php(635): WPCF7_Mail::send(Array, 'mail')
#18 /home/DOMAIN/public_html/wp-content/plugins/contact-form-7/includes/submission.php(98): WPCF7_Submission->mail()
#19 /home/DOMAIN/public_html/wp-content/plugins/contact-form-7/includes/submission.php(27): WPCF7_Submission->proceed()
#20 /home/DOMAIN/public_html/wp-content/plugins/contact-form-7/includes/contact-form.php(1042): WPCF7_Submission::get_instance(Object(WPCF7_ContactForm), Array)
#21 /home/DOMAIN/public_html/wp-content/plugins/contact-form-7/includes/rest-api.php(336): WPCF7_ContactForm->submit()
#22 /home/DOMAIN/public_html/wp-includes/rest-api/class-wp-rest-server.php(1140): WPCF7_REST_Controller->create_feedback(Object(WP_REST_Request))
#23 /home/DOMAIN/public_html/wp-includes/rest-api/class-wp-rest-server.php(987): WP_REST_Server->respond_to_request(Object(WP_REST_Request), '/contact-form-7...', Array, NULL)
#24 /home/DOMAIN/public_html/wp-includes/rest-api/class-wp-rest-server.php(414): WP_REST_Server->dispatch(Object(WP_REST_Request))
#25 /home/DOMAIN/public_html/wp-includes/rest-api.php(370): WP_REST_Server->serve_request('/contact-form-7...')
#26 /home/DOMAIN/public_html/wp-includes/class-wp-hook.php(303): rest_api_loaded(Object(WP))
#27 /home/DOMAIN/public_html/wp-includes/class-wp-hook.php(327): WP_Hook->apply_filters('', Array)
#28 /home/DOMAIN/public_html/wp-includes/plugin.php(518): WP_Hook->do_action(Array)
#29 /home/DOMAIN/public_html/wp-includes/class-wp.php(388): do_action_ref_array('parse_request', Array)
#30 /home/DOMAIN/public_html/wp-includes/class-wp.php(750): WP->parse_request('')
#31 /home/DOMAIN/public_html/wp-includes/functions.php(1291): WP->main('')
#32 /home/DOMAIN/public_html/wp-blog-header.php(16): wp()
#33 /home/DOMAIN/public_html/index.php(17): require('/home/DOMAIN/p...')
#34 {main}
  thrown in /home/DOMAIN/public_html/wp-includes/class-wp-block-parser.php on line 417

Unfortunately this was the only reference to the error I found on the server…

I got further information from CPanel. Can you update your 1.7.1 patch here? They use patchstack as the source for their vulnerability DB.

https://patchstack.com/database/vulnerability/contact-form-submissions/wordpress-contact-form-submissions-plugin-1-6-4-authenticated-sql-injection-sqli-vulnerability

https://patchstack.com/database/vulnerability/contact-form-submissions/wordpress-contact-form-submissions-plugin-1-6-4-authenticated-double-query-sql-injection-sqli-vulnerability

I opened a ticket with CPanel, they confirmed that this is a false positive and 1.7.1 is not vulnerable. They have submitted a report to their team.

Yes, it’s fine. Thanks

SOLVED
Ok, played around with WP ToolKit some more. Looks like it requires the end slash.
So enter new_login_name/ instead of new_login_name and it works like a champ!

Hello Amin,
Wow, thanks for the quick reply.
Cheers!
Paul