CVE-2018-25346— WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| 10Web | Form Maker | ≤ 1.12.24 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2018-25346
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php
Source: CVE Program / CVE List V5
Vulnerability Description
WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin Form Maker SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin Form Maker 1.12.24及之前版本存在SQL注入漏洞，该漏洞源于通过FormMakerSQLMapping和generete_csv操作注入SQL代码，可能导致已认证攻击者操纵数据库查询，提取、修改数据或
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| 10Web | Form Maker | 0 ~ 1.12.24 | - |
II. Public POCs for CVE-2018-25346
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-25346
请登录查看更多情报信息。
Exploits & Public PoCs for CVE-2018-25346 (1)
News Coverage for CVE-2018-25346 (1)
IV. Related Vulnerabilities
Same vendor: 10Web
- CVE-2026-66635
WordPress Slider by 10Web plugin <= 1.2.62 - CSRF to Arbitra - CVE-2026-15993
Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) - CVE-2026-11776
Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrato - CVE-2026-11777
Form Maker by 10Web <= 1.15.43 - Authenticated (Administrato - CVE-2026-39502
WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Inject
Same weakness: CWE-89
- CVE-2026-54348
Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddr - CVE-2026-47720
FUXA: SQL injection in TDengine DAQ connector via backslash - CVE-2026-75876
xianrendzw EasyReport Move Operations ModuleController.java - CVE-2026-74015
WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerab - CVE-2026-73392
WordPress Super Store Finder plugin <= 7.8 - SQL Injection v
V. Comments for CVE-2018-25346
No comments yet