CVE-2018-25346 - CVE House

Back to Database

Status published High CVE-2018-25346

WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php

7.1 CVSS

Vulnerability Description

WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-25346

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Neven Biruski

References

More from 10Web

View All →

WordPress Form Maker by 10Web plugin <= 1.15.33 - Cross Site Scripting (XSS) Vulnerability

WordPress Photo Gallery by 10Web plugin <= 1.8.27 - Cross Site Scripting (XSS) vulnerability

WordPress Sliderby10Web plugin <= 1.2.54 - Cross Site Scripting (XSS) vulnerability

WordPress 10Web Map Builder for Google Maps plugin <= 1.0.74 - SQL Injection vulnerability

WordPress Photo Gallery Plugin <= 1.8.21 Stored Cross Site Scripting in UploadHandler

Affected Vendor

10Web

View all reports →

Affected Software

Form Maker

Vulnerable Versions:

0

Timeline

Official Publish: May 23rd, 2026

Last Modified: May 26th, 2026

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1213.006 Databases

T1485 Data Destruction