PT-2026-43063 · WordPress · Ultimate-Form-Builder-Lite

Published 2026-05-23 · Updated 2026-05-23 · CVE-2018-25352

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress Ultimate Form Builder Lite versions prior to 1.3.8

Description Authenticated attackers can manipulate database queries by injecting SQL code through the entry id POST parameter. This is achieved by sending POST requests to the 'admin-ajax.php' endpoint using the ufbl get entry detail action action, which may allow the extraction of data, modification of records, or privilege escalation within the WordPress database.

Recommendations Update to a version later than 1.3.7. As a temporary workaround, restrict access to the 'admin-ajax.php' endpoint or avoid using the entry id parameter until the update is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-25352

Affected Products

Ultimate-Form-Builder-Lite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-25352 · Security Note
• https://vulncheck.com/advisories/wordpress-ultimate-form-builder-lite-sql-injection-via-entry-id · Note
• http://vulnerablesite.com/wp-admin/admin-ajax.php · Note
• https://exploit-db.com/exploits/44884 · Note
• https://t.me/CVEtracker/54729 · Telegram Post