WordPress Contact Form Maker Plugin version 1.12.20 contains a SQL injection vulnerability that occurs when authenticated attackers manipulate the FormMakerSQLMapping and generete_csv_fmc AJAX actions. By injecting malicious SQL through the name and search_labels parameters, an attacker can query or modify the underlying database, read sensitive data, and potentially elevate their privileges within the WordPress site.

The affected product is Web‑Dorado’s Contact Form Maker plugin for WordPress, specifically version 1.12.20. No other product or version information was disclosed.

The vulnerability has a CVSS score of 7.1, indicating a high severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the plugin’s AJAX endpoints, so attackers must use valid user credentials or exploit a broader authentication vulnerability. The attack vector is likely web‑based, and the misuse of the unsecured parameters could allow an attacker to retrieve or alter sensitive data, potentially compromising server integrity and confidentiality.