Executive brief
The Contact Form Maker plugin for WordPress, used to create interactive forms, contains a security flaw that allows logged-in users to interfere with the website's database. By sending specially crafted requests, an attacker could steal sensitive information or gain higher-level administrative access to the site. This could lead to a full site takeover or the exposure of private user data.
Technical details
The Contact Form Maker plugin for WordPress (version 1.12.20 and earlier) is vulnerable to SQL injection via the 'FormMakerSQLMapping' and 'generete_csv_fmc' AJAX actions. The vulnerability exists because the 'name' and 'search_labels' parameters are not properly sanitized before being used in SQL queries. An authenticated attacker with low-level privileges can exploit this by sending malicious SQL commands to the 'admin-ajax.php' endpoint. Successful exploitation allows the attacker to extract sensitive data from the database, modify records, or potentially escalate their privileges to an administrator. The plugin has been permanently closed on the WordPress repository and users are advised to migrate to a supported alternative.
Affected products
- 10Web (WebDorado) Contact Form Maker <= 1.12.20
Timeline
- 2018-06-07: disclosed: Initial exploit code published on Exploit-DB
- 2023-06-15: other: Plugin permanently closed on WordPress.org at author request
- 2026-05-23: advisory: CVE-2018-25347 published via VulnCheck/NVD