CVE-2018-25346

HighCVSS 7.1/10Last modified Jul 23, 2026

Description

WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 23, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2018

CVE-2018-253477.1WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate databaseCVE-2018-253488.2Joomla! Component Ek Rishta 2.10 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database querieCVE-2018-253496.1userSpice 4.3.24 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the X-Forwarded-ForCVE-2018-253509.8userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending CVE-2018-253518.2Joomla! Component EkRishta 2.10 contains an error-based SQL injection vulnerability that allows unauthenticated attackers to execute arbitraCVE-2018-253527.1WordPress Ultimate Form Builder Lite plugin version 1.3.7 and below contains an SQL injection vulnerability that allows authenticated attackCVE-2018-253538.8Redaxo CMS Mediapool Addon 5.5.1 and older contains an arbitrary file upload vulnerability that allows authenticated users to bypass file exCVE-2018-253544.3Joomla Component jomres 9.11.2 contains a cross-site request forgery vulnerability that allows attackers to modify user account information CVE-2018-253558.4Audiograbber 1.83 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exCVE-2018-253568.4SIPp 3.6 and earlier contains a local buffer overflow vulnerability in command-line argument handling that allows local attackers to crash tCVE-2018-253579.8Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injCVE-2018-253587.5D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuratio
CVE-2018-25346: High severity, CVSS 7.1 | Vulnix