CVE-2018-25346
HighSummary
The WordPress Form Maker plugin version 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters.
Risk Assessment
This vulnerability may lead to data leakage, data modification, or privilege escalation within the WordPress database, posing a serious security threat to the organization.
Recommendation
It is recommended to update the Form Maker plugin to the latest version to mitigate these vulnerabilities and to monitor logs for potential attack attempts.
Original NVD description (English source)
WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database.