CVE-2018-25352 HIGH

CVE-2018-25352: WordPress Ultimate Form Builder Lite 1.3.7 SQL Injection via entry_id

Vendor Ultimate-Form-Builder-Lite
Product Ultimate Form Builder Lite
Weakness CWE-89 · SQLi
Published May 23, 2026
Last update May 26, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

Description

WordPress Ultimate Form Builder Lite plugin version 1.3.7 and below contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the entry_id POST parameter. Attackers can send POST requests to the admin-ajax.php endpoint with the ufbl_get_entry_detail_action action to extract, modify, or escalate privileges within the WordPress database.

Key dates

Disclosure timeline

May 23, 2026 CVE published
May 26, 2026 Record updated