CVE-2018-25346: WordPress Form Maker Plugin SQLi Flaw

CVE-2018-25346 Overview

CVE-2018-25346 is a SQL injection vulnerability in the WordPress Form Maker Plugin version 1.12.24 and below. The flaw exists in the plugin's AJAX handlers, specifically the FormMakerSQLMapping and generete_csv actions exposed through admin-ajax.php. Authenticated attackers can inject malicious SQL payloads through the name and search_labels POST parameters. Successful exploitation allows attackers to read database contents, modify records, and potentially escalate privileges within the WordPress instance. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Authenticated attackers can manipulate WordPress database queries to extract sensitive data, alter records, or escalate privileges through unsanitized AJAX parameters.

Affected Products

• WordPress Form Maker Plugin version 1.12.24
• WordPress Form Maker Plugin versions below 1.12.24
• WordPress installations running the vulnerable plugin with authenticated low-privilege users

Discovery Timeline

• 2026-05-23 - CVE-2018-25346 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2018-25346

Vulnerability Analysis

The vulnerability resides in the WordPress Form Maker Plugin's handling of authenticated AJAX requests routed through admin-ajax.php. The FormMakerSQLMapping and generete_csv actions accept user-controlled input in the name and search_labels POST parameters. The plugin concatenates these values directly into SQL statements without sanitization or parameterization. Attackers with a valid authenticated session, even at low privilege levels, can submit crafted POST requests that break out of the intended query context. This allows arbitrary SQL execution against the WordPress backend database. The flaw enables data exfiltration of credentials, session tokens, and configuration values stored in wp_users and wp_options.

Root Cause

The root cause is improper neutralization of special characters in SQL commands [CWE-89]. The plugin fails to use prepared statements or apply WordPress core functions such as $wpdb->prepare() when constructing queries from request parameters. User-supplied data flows directly into database query strings, breaking the separation between code and data.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated session. The attacker sends a POST request to /wp-admin/admin-ajax.php with the action parameter set to FormMakerSQLMapping or generete_csv. Malicious SQL payloads are placed in the name or search_labels parameters. The vulnerability is documented in the Exploit-DB #44853 entry and the VulnCheck WordPress Advisory. No verified code examples are available in this enrichment; refer to the referenced advisories for payload specifics.

Detection Methods for CVE-2018-25346

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php containing the action=FormMakerSQLMapping or action=generete_csv parameters
• Request bodies containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the name or search_labels parameters
• Unexpected new administrator accounts in wp_users or modifications to wp_options
• Database errors logged by WordPress or MySQL referencing Form Maker plugin queries

Detection Strategies

• Inspect web server access logs for POST requests to admin-ajax.php referencing the vulnerable actions with suspicious payload patterns
• Deploy web application firewall rules that detect SQL injection signatures in name and search_labels POST parameters
• Enable MySQL query logging on WordPress databases to identify malformed or unexpected queries originating from the plugin

Monitoring Recommendations

• Monitor authentication logs for low-privilege account activity preceding suspicious AJAX requests
• Track changes to privileged WordPress tables including wp_users, wp_usermeta, and wp_options
• Alert on outbound data transfers from web servers that correlate with database query spikes

How to Mitigate CVE-2018-25346

Immediate Actions Required

• Update the WordPress Form Maker Plugin to a version above 1.12.24 that addresses the SQL injection flaw
• Audit all WordPress user accounts and revoke unnecessary privileges, particularly for accounts that can submit forms
• Review database contents for unauthorized modifications, especially in wp_users and wp_options
• Rotate WordPress administrator passwords and invalidate active sessions

Patch Information

Upgrade the Form Maker Plugin to a fixed release as referenced in the VulnCheck WordPress Advisory. Verify the installed plugin version through the WordPress admin Plugins page after applying the update. Confirm that the FormMakerSQLMapping and generete_csv AJAX handlers use parameterized queries in the patched code.

Workarounds

• Disable or remove the Form Maker Plugin until the patch is applied
• Restrict access to /wp-admin/admin-ajax.php from untrusted networks using web server access controls
• Deploy a web application firewall with SQL injection protection rules targeting the affected action parameters
• Limit authenticated user privileges so compromised low-level accounts cannot reach the vulnerable AJAX handlers