CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database.
Explanation of Vulnerability in Simple Terms
Form Maker versions up to 1.12.24 contain a SQL injection vulnerability in form processing. An attacker with low-level user access can inject malicious SQL commands through form input fields, potentially reading or modifying the site database. The vulnerability requires authentication but no user interaction beyond normal form submission.
What an attacker can do
Read or modify database contents by injecting SQL commands through form fields.
Potential impact on your site
Unauthorized database access could expose user data, form submissions, or allow modification of site content.
Conditions required to exploit
Attacker must have low-level user account access to the site.
Key dates
External resources
Related vulnerabilities
