7.1Alta

CVE-2018-25346WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php

10Web Form Maker Publicada: 2026-05-23 21:30 (hace 5 meses)

Descripción

WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database.

Debilidad (CWE): CWE-89

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
10Web	Form Maker	≤ 1.12.24

Referencias y parches

ExploitDB-44853 exploit
VulnCheck Advisory: WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php third-party-advisory

Puntuación CVSS

7.1Alta

Fuente: VulnCheck · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Bajos
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Alto
Integridad: Bajo
Disponibilidad: Ninguno

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Todas las puntuaciones (4)

cna	CVSS 4.0	7.1Alta
cna	CVSS 3.1	7.1Alta
disclosure@vulncheck.com	CVSS 4.0	7.1Alta
disclosure@vulncheck.com	CVSS 3.1	7.1Alta

EPSS (probabilidad de explotación en 30 días)

0.20%

superior al 9 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: poc
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2026-05-23
Publicada2026-05-23 21:30
Llegó a IP-DB2026-10-25 00:05
Última actualización2026-07-23 19:10

Asignada por (CNA): VulnCheck
Estado en NVD: Deferred

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — WordPress plugins & themes

Sin puntuación

CVE-2026-110132 hace 4 horas

Sync Post With Other Site 1.9.3 - Contributor+ Arbitrary Custom Post Type Creation and Modification

Sync Post With Other Site

The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify arbitrary custom post types, includ…

Sin puntuación

CVE-2026-110963 hace 4 horas

Userplace <= 1.2.0 - Unauthenticated Privilege Escalation

Userplace

The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or …

Sin puntuación

CVE-2026-104639 hace 4 horas

Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook

Razorpay for WooCommerce

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection…

Sin puntuación

CVE-2026-105970 hace 4 horas

BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation

Thanh Toán Quét Mã QR Code Tự Động

The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders…

Sin puntuación

CVE-2026-106015 hace 4 horas

Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force

Ecommerce Affiliate

The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including admin…

Sin puntuación

CVE-2026-109925 hace 4 horas

Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare Handlers

Productive Commerce

The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.