PT-2026-43058 · WordPress · Contact Form Maker

Published 2026-05-23 · Updated 2026-05-23 · CVE-2018-25347

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress Contact Form Maker Plugin version 1.12.20

Description Authenticated attackers can manipulate database queries through the 'FormMakerSQLMapping' and 'generete csv fmc' AJAX actions. By injecting malicious SQL code via the name and search labels parameters, attackers may extract sensitive database information or escalate privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-25347

Affected Products

Contact Form Maker

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-25347 · Security Note
• https://vulncheck.com/advisories/wordpress-contact-form-maker-plugin-sql-injection · Note
• https://wordpress.org/plugins/contact-form-maker · Note
• https://t.me/CVEtracker/54724 · Telegram Post
• https://exploit-db.com/exploits/44854 · Note