A flaw in the Form Builder CP WordPress plugin improperly neutralizes special characters in user‑supplied data before embedding them into SQL statements. An attacker can inject SQL code that is executed by the backend database, potentially allowing the disclosure, modification, or deletion of arbitrary data stored by the site. The vulnerability is classified as CWE‑89, indicating a classic parameter injection weakness.

The affected product is the WordPress "Form Builder CP" plugin from codepeople, for all released versions up to and including 1.2.41. Any WordPress site that has this plugin installed is potentially vulnerable.

With a CVSS score of 8.5 the severity is high. The EPSS score is less than 1%, indicating a low probability of current exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote, via a crafted HTTP request to the plugin’s form submission endpoint. No authentication is required, meaning the vulnerability can be triggered by any user who can reach the affected page.