Executive brief
SAMO Forms is a WordPress plugin used to create and manage forms on websites. The plugin fails to properly validate user input in form submissions, allowing attackers to inject malicious SQL commands without authentication. This could enable attackers to steal sensitive data from the site's database, modify or delete records, or potentially gain full control of the website.
Technical details
The SAMO Forms plugin through version 1.0.0 contains a SQL injection (SQLi) vulnerability in several unauthenticated actions due to inadequate input sanitization and escaping. User-supplied input is directly concatenated into SQL queries without proper parameterization or filtering. The vulnerability is accessible without authentication, making it remotely exploitable over the network. Attackers can craft malicious input to extract arbitrary data from the database, modify records, or execute administrative commands depending on database permissions. No official patch has been identified at the time of publication; users should update to a version newer than 1.0.0 or implement a Web Application Firewall (WAF) until fixes are available.
Affected products
- SAMO Forms through 1.0.0
Timeline
- 2026-09-10: disclosed
- 2026-09-12: advisory