PT-2026-43057 · WordPress · Form Maker

Published 2026-05-23 · Updated 2026-05-23 · CVE-2018-25346

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress Form Maker Plugin versions prior to 1.12.25

Description Authenticated attackers can manipulate database queries by injecting SQL code through the 'FormMakerSQLMapping' and 'generete csv' actions. This is achieved by submitting POST requests to the '/admin-ajax.php' endpoint containing malicious SQL payloads in the name and search labels parameters. Such actions may allow the extraction of data, modification of records, or privilege escalation within the WordPress database.

Recommendations Update to a version newer than 1.12.24. As a temporary workaround, restrict access to the '/admin-ajax.php' endpoint or limit the use of the name and search labels parameters within the 'FormMakerSQLMapping' and 'generete csv' actions.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-25346

Affected Products

Form Maker

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-25346 · Security Note
• https://t.me/CVEtracker/54723 · Telegram Post
• https://exploit-db.com/exploits/44853 · Note
• https://vulncheck.com/advisories/wordpress-form-maker-plugin-sql-injection-via-admin-ajax-php · Note