CVE-2026-93773: Mollie Forms SQL Injection Vulnerability

CVE-2026-93773 Overview

CVE-2026-93773 is a SQL injection vulnerability affecting the Mollie Forms plugin for WordPress in versions up to and including 2.11.0. The flaw is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). An authenticated attacker holding Contributor-level privileges can inject arbitrary SQL statements into database queries executed by the plugin. Successful exploitation allows attackers to read sensitive data from the WordPress database and cause limited availability impact. The scope is changed, meaning the vulnerability can affect resources beyond the vulnerable component itself.

Critical Impact
An authenticated Contributor can extract confidential database contents, including user records and secrets stored by other plugins, from any WordPress site running Mollie Forms <= 2.11.0.

Affected Products

Mollie Forms plugin for WordPress, versions <= 2.11.0
WordPress installations that permit Contributor-level account registration
Sites relying on Mollie Forms for payment or subscription form workflows

Discovery Timeline

2026-09-23 - CVE-2026-93773 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-93773

Vulnerability Analysis

The vulnerability resides in database query construction within the Mollie Forms plugin. User-controlled input reachable by a Contributor account is concatenated into SQL statements without sufficient sanitization or parameterization. Because WordPress Contributors can author draft content and interact with a subset of plugin endpoints, the attack surface is broader than administrator-only issues.

Exploitation is performed over the network against the WordPress HTTP interface. The attacker submits crafted request parameters that break out of the intended query context and append attacker-controlled SQL clauses. This yields read access to arbitrary tables in the wp_ schema, including wp_users and wp_usermeta. Availability can also be degraded through resource-intensive injected queries.

Refer to the Patchstack Vulnerability Report for the vendor-coordinated technical write-up.

Root Cause

The root cause is improper neutralization of special elements in SQL commands [CWE-89]. The affected code paths build queries using string concatenation with request parameters instead of using $wpdb->prepare() with placeholders. Sanitization functions such as sanitize_text_field() do not neutralize SQL metacharacters and cannot substitute for parameterized queries.

Attack Vector

The attacker first obtains or registers a Contributor account on the target WordPress site. They then send authenticated HTTP requests to a vulnerable Mollie Forms endpoint with a payload embedded in a query parameter. The payload alters the intended query, typically using UNION SELECT or boolean-based blind techniques to exfiltrate data row by row.

See the Patchstack advisory for coordinated disclosure details. No public proof-of-concept exploit is currently documented.

Detection Methods for CVE-2026-93773

Indicators of Compromise

HTTP requests to Mollie Forms endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, BENCHMARK(, or information_schema in query parameters or POST bodies.
Authenticated requests from Contributor accounts to plugin AJAX or REST routes at abnormal frequency.
Unexpected response time spikes correlated with parameter values that include time-based SQL functions.
Database error strings such as You have an error in your SQL syntax appearing in web server or PHP logs.

Detection Strategies

Inspect web server access logs for parameters containing SQL syntax targeting Mollie Forms URIs.
Enable MySQL general query logging temporarily to identify queries with concatenated user input reaching Mollie Forms tables.
Deploy a web application firewall rule set that flags SQL injection patterns on authenticated WordPress endpoints.

Monitoring Recommendations

Monitor creation of new Contributor accounts and correlate with subsequent requests to plugin endpoints.
Alert on WordPress wp_users or wp_options table reads originating from PHP workers outside of expected admin workflows.
Track outbound data volumes from the web tier to identify bulk extraction consistent with UNION-based injection.

How to Mitigate CVE-2026-93773

Immediate Actions Required

Upgrade the Mollie Forms plugin to a version later than 2.11.0 once the vendor publishes a fixed release.
Audit all Contributor and higher accounts and remove any that are unrecognized or unnecessary.
Disable open user registration or restrict the default role to Subscriber until patched.
Rotate credentials, API keys, and secrets that may have been stored in the WordPress database.

Patch Information

Refer to the Patchstack Vulnerability Report for Mollie Forms for current patch status and fixed version information. Apply the vendor update through the WordPress plugin manager as soon as it is available.

Workarounds

Deactivate the Mollie Forms plugin until a patched version is installed if payment form functionality is not business-critical.
Deploy a WordPress-aware web application firewall, such as Patchstack or Wordfence, with virtual patching for this CVE.
Restrict access to wp-admin and plugin AJAX endpoints by IP allowlist where operationally feasible.

bash

# Temporarily deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate mollie-forms

# Verify current installed version
wp plugin get mollie-forms --field=version

# After vendor patch is released, update to the fixed version
wp plugin update mollie-forms