CVE-2018-25347: WordPress Contact Form Maker SQL Injection

CVE-2018-25347 Overview

CVE-2018-25347 is a SQL injection vulnerability [CWE-89] in the WordPress Contact Form Maker plugin version 1.12.20. Authenticated attackers can manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. The vulnerability accepts attacker-controlled input via the name and search_labels parameters without proper sanitization. Successful exploitation enables extraction of sensitive database contents, including user credentials and session data. Attackers with low-privilege WordPress accounts can leverage this flaw to escalate privileges or pivot to broader site compromise.

Critical Impact

Authenticated SQL injection in WordPress Contact Form Maker 1.12.20 allows database extraction and potential privilege escalation through unsanitized AJAX action parameters.

Affected Products

• WordPress Contact Form Maker Plugin version 1.12.20
• WordPress installations using the vulnerable plugin version
• Sites exposing the FormMakerSQLMapping and generete_csv_fmc AJAX endpoints

Discovery Timeline

• 2026-05-23 - CVE-2018-25347 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2018-25347

Vulnerability Analysis

The Contact Form Maker plugin registers two AJAX actions, FormMakerSQLMapping and generete_csv_fmc, that handle form data retrieval and CSV export operations. Both endpoints accept user-supplied input through HTTP request parameters and concatenate that input into SQL statements without parameterized queries or proper escaping.

Attackers authenticated to WordPress as low-privilege users send crafted requests targeting these AJAX handlers. The name parameter feeds the FormMakerSQLMapping action, while search_labels is processed by generete_csv_fmc. Both flow into database query construction directly.

The attack requires only a valid WordPress session, which can include subscriber-level accounts on sites permitting open registration. Successful injection returns query output that can include WordPress user hashes from the wp_users table, secret keys, and other application data.

Root Cause

The root cause is failure to apply WordPress's prepared statement API ($wpdb->prepare()) or input sanitization functions such as esc_sql() to the name and search_labels parameters before SQL execution. The plugin trusts authenticated input implicitly, mapping CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Attack Vector

The attack vector is network-based and requires authentication. An attacker sends an HTTP POST request to /wp-admin/admin-ajax.php specifying action=FormMakerSQLMapping or action=generete_csv_fmc with a malicious payload in the name or search_labels field. The payload uses UNION-based or boolean-based injection techniques to read arbitrary tables in the WordPress database.

No verified proof-of-concept code is reproduced here. Refer to Exploit-DB #44854 and the VulnCheck SQL Injection Advisory for technical exploit details.

Detection Methods for CVE-2018-25347

Indicators of Compromise

• HTTP POST requests to /wp-admin/admin-ajax.php containing action=FormMakerSQLMapping or action=generete_csv_fmc with SQL syntax in the name or search_labels parameter
• Unusual UNION SELECT, SLEEP(, or INFORMATION_SCHEMA strings in WordPress access logs tied to authenticated sessions
• Unexpected database query errors logged by MySQL or MariaDB referencing the wp_formmaker_* tables
• New or modified WordPress administrator accounts created shortly after suspicious AJAX traffic

Detection Strategies

• Inspect web server and WordPress access logs for the two vulnerable AJAX actions combined with SQL metacharacters such as single quotes, parentheses, or comment sequences
• Deploy a web application firewall rule that flags requests to admin-ajax.php containing SQL keywords in the name and search_labels POST fields
• Correlate authenticated session activity with database error rates to identify exploitation attempts that trigger malformed queries

Monitoring Recommendations

• Enable WordPress audit logging to track plugin AJAX usage by low-privilege accounts
• Forward web server, application, and database logs to a centralized analytics platform for cross-source correlation
• Alert on authentication events from new IP addresses that immediately interact with admin-ajax.php plugin endpoints

How to Mitigate CVE-2018-25347

Immediate Actions Required

• Identify all WordPress sites running Contact Form Maker 1.12.20 and upgrade to the latest patched release available on the WordPress Plugin repository
• Disable open user registration where it is not required, reducing the pool of accounts that can authenticate and reach the vulnerable AJAX actions
• Audit existing WordPress user accounts for unauthorized administrators or recently elevated privileges
• Rotate WordPress authentication secrets in wp-config.php and force password resets if exploitation is suspected

Patch Information

Upgrade Contact Form Maker beyond version 1.12.20 to a release that parameterizes queries in the FormMakerSQLMapping and generete_csv_fmc handlers. Consult the WordPress Plugin Overview for the current supported version and changelog details.

Workarounds

• Deactivate and remove the Contact Form Maker plugin until a patched version is deployed
• Restrict access to /wp-admin/admin-ajax.php from untrusted networks using a web application firewall or reverse proxy ACL
• Add WAF signatures that block SQL metacharacters in the name and search_labels parameters when the action value matches the vulnerable handlers
• Limit database privileges of the WordPress MySQL user to the minimum required, preventing access to non-WordPress schemas

# Example WAF rule (ModSecurity) blocking SQLi in vulnerable AJAX actions
SecRule ARGS:action "@rx ^(FormMakerSQLMapping|generete_csv_fmc)$" \
  "id:1002501,phase:2,deny,status:403,log,\
   chain,msg:'Contact Form Maker SQLi attempt (CVE-2018-25347)'"
  SecRule ARGS:name|ARGS:search_labels \
    "@rx (?i)(union\s+select|sleep\(|information_schema|--|/\*)" \
    "t:none,t:urlDecodeUni"