CVE-2018-25346CWE-89

WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php

High · published May 23, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
8.9
In the wild
Unconfirmed
What it is

WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00197 · 8.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-05-23T18:30Z
EPSS history
Timeline
  • 23 MAY 18:30Z
    WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php
    cvelistv5