This vulnerability allows an authenticated attacker to inject arbitrary SQL through the entry_id POST parameter in the admin-ajax.php endpoint. The injection is possible when the plugin action ufbl_get_entry_detail_action is called, enabling the attacker to read, modify, or potentially elevate privileges within the WordPress database. This is a classic SQL injection flaw (CWE‑89), which directly jeopardizes confidentiality, integrity, and availability of the data stored by the plugin, as an intruder could exfiltrate sensitive information or alter database content.

Any WordPress site running Ultimate Form Builder Lite version 1.3.7 or earlier is affected. The plugin is distributed under the vendor accesspressthemes and commonly used on WordPress installations that manage form entries or submissions.

The CVSS score for this issue is 7.1, indicating a high severity. No EPSS score is currently available, so the exploitation probability is not quantified, and it is not listed in the CISA KEV catalog. Attackers must be authenticated and have permission to send POST requests to admin-ajax.php, which is a common path for legitimate WordPress administrative activity. The attack vector is inferred to be local network or web-based, as it relies on the request structure of the plugin’s AJAX endpoint.