Wow Forms WordPress Plugin version 2.1 is vulnerable to a classic SQL injection flaw (CWE-89). By sending a crafted POST request containing the "mwpformid" parameter to the admin-ajax.php endpoint with the action "send_mwp_form", an attacker can read any table in the site's database. The flaw allows full exposure of sensitive information, such as user credentials and site content, without requiring credentials or authentication, thereby compromising confidentiality.

The affected product is the Wow Forms plugin developed by Wow‑Company. Only the 2.1 release for WordPress is impacted. No other versions or products are listed as affected.

The vulnerability carries a CVSS score of 8.8, indicating a high severity. No EPSS score is available, so the current exploitation probability is unknown, but the absence of a KEV listing suggests no confirmed exploits in the wild yet. The likely attack vector is remote via the web interface – any user able to make a POST request to the vulnerable endpoint can exploit the flaw, making the attack possible without any special privileges or credentials.