CVE-2026-80491: SAMO Forms WordPress Plugin SQLi Vulnerability

CVE-2026-80491 Overview

CVE-2026-80491 is an unauthenticated SQL injection vulnerability in the SAMO Forms WordPress plugin through version 1.0.0. The plugin fails to properly sanitize and escape user-supplied input before using it in SQL queries across several unauthenticated actions. Remote attackers can inject arbitrary SQL statements without any authentication or user interaction. The flaw is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can extract sensitive database contents from affected WordPress sites, including user credentials, session tokens, and site configuration data.

Affected Products

SAMO Forms WordPress plugin, all versions through 1.0.0
WordPress sites with the vulnerable plugin installed and activated
No fixed version has been published at the time of NVD disclosure

Discovery Timeline

2026-09-12 - CVE-2026-80491 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80491

Vulnerability Analysis

The SAMO Forms plugin exposes several actions that accept user-controlled parameters and concatenate them directly into SQL statements. Because these actions are reachable without authentication, any remote client can send crafted HTTP requests to the vulnerable endpoints. The attacker gains the ability to modify query semantics, extract database rows through UNION-based or boolean-based techniques, and enumerate the underlying schema.

The scope change reflected in the CVSS vector indicates that a successful attack can affect resources beyond the plugin's initial security context. In WordPress environments, this typically means access to the full wp_ database, including the wp_users table containing password hashes and the wp_options table containing site secrets.

Root Cause

The vulnerability stems from the absence of parameterized queries and input sanitization. The plugin does not use $wpdb->prepare() or equivalent escaping functions before interpolating request parameters into SQL statements. This design flaw is a textbook example of [CWE-89] and is exploitable through standard SQL injection payloads.

Attack Vector

An attacker delivers a crafted HTTP request to a vulnerable AJAX or public action registered by the plugin. The malicious parameter contains SQL metacharacters that break out of the intended query context. The database server then executes the injected statement with the privileges of the WordPress database user. See the WPScan Vulnerability Report for the specific vulnerable actions and parameters.

No verified proof-of-concept code is publicly available. Exploitation follows the standard pattern for WordPress plugin SQL injection: attackers identify the vulnerable endpoint through the plugin source, then submit crafted POST or GET requests containing SQL payloads.

Detection Methods for CVE-2026-80491

Indicators of Compromise

HTTP requests to SAMO Forms plugin endpoints containing SQL metacharacters such as UNION SELECT, SLEEP(, OR 1=1, or hexadecimal-encoded payloads.
Unexpected admin-ajax.php traffic referencing SAMO Forms actions from unauthenticated sessions.
Anomalous database query patterns in MySQL slow query logs, particularly long-running or malformed statements originating from the WordPress user.
New or modified administrator accounts in wp_users that do not correspond to legitimate provisioning activity.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect request parameters for SQL injection patterns targeting SAMO Forms action names.
Enable MySQL general query logging temporarily on suspected sites and search for queries containing concatenated user input from plugin handlers.
Correlate HTTP access logs with database query logs to identify unauthenticated requests that produced complex SQL statements.

Monitoring Recommendations

Alert on outbound data volume spikes from web servers hosting the plugin, which may indicate database extraction.
Monitor WordPress audit logs for unexpected privilege changes, option modifications, or new plugin installations following suspicious traffic.
Track failed login attempts using credential formats consistent with hashes exfiltrated from wp_users.

How to Mitigate CVE-2026-80491

Immediate Actions Required

Deactivate and remove the SAMO Forms plugin from all WordPress installations until a patched version is released.
Review web server access logs for requests to plugin endpoints dating back to the plugin's installation date.
Rotate all WordPress administrator passwords, secret keys in wp-config.php, and any API tokens stored in the database.
Audit the wp_users table for unauthorized accounts and remove any that cannot be attributed to legitimate administrators.

Patch Information

At the time of NVD publication, no fixed version of the SAMO Forms plugin has been released. Refer to the WPScan Vulnerability Report for updates on vendor remediation status. Administrators should treat the plugin as unpatched and plan for removal rather than upgrade.

Workarounds

Block requests to SAMO Forms plugin endpoints at the WAF or reverse proxy layer until the plugin is removed or patched.
Restrict database user privileges for the WordPress account to the minimum required, preventing schema enumeration where possible.
Enforce IP allow-listing for the /wp-admin/ and /wp-content/plugins/samo-forms/ paths on sites that cannot immediately remove the plugin.

bash

# Example Nginx configuration to block requests to the vulnerable plugin path
location ~* /wp-content/plugins/samo-forms/ {
    deny all;
    return 403;
}