PT-2026-43058

CVE-2018-25347

·

Published

2026-05-23

·

Updated

2026-05-23

Description by

CVSS 3.1
7.1
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Name of the Vulnerable Software and Affected Versions WordPress Contact Form Maker Plugin version 1.12.20
Description Authenticated attackers can manipulate database queries through the 'FormMakerSQLMapping' and 'generete csv fmc' AJAX actions. By injecting malicious SQL code via the name and search labels parameters, attackers may extract sensitive database information or escalate privileges.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Impacts
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2018-25347
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com