The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to SQL Injection through the 'params' parameter in all versions up to 1.4.13. The flaw arises from insufficient escaping and lack of query preparation, allowing an authenticated attacker with Administrator or higher privileges to append arbitrary SQL fragments to existing queries. This vulnerability enables the extraction of sensitive information from the database, constituting a significant risk to data confidentiality.

WordPress users running the Form Vibes – Database Manager for Forms plugin version 1.4.13 or earlier are impacted. The plugin, developed by wpvibes, integrates with WordPress sites to manage form data. Any site that still hosts these versions should consider the vulnerability.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploit in the wild. However, the exploit requires authenticated access with Administrator-level rights, meaning the threat mainly originates from compromised or malicious privileged accounts. The vulnerability is not listed in the CISA KEV catalog. An attacker who gains admin credentials could exploit the injection to read or manipulate database contents, potentially exposing user data and damaging site integrity.