The GoZen Forms WordPress plugin contains a vulnerability in the dirGZActiveForm() function; the forms-id parameter is not properly escaped or prepared in the underlying SQL statement. An unauthenticated attacker can supply a crafted forms-id value that appends additional SQL statements, allowing the injection of arbitrary queries. This defect is classified as CWE‑89 and permits attackers to retrieve sensitive database data such as user credentials, content, and configuration information, thereby compromising confidentiality of the WordPress site and its database.

Affected are installations of the optinlyhq GoZen Forms plugin for WordPress that are version 1.1.5 or earlier. The vulnerability exists in all releases up to and including 1.1.5 and can be exploited on any WordPress installation that has the plugin enabled and accessible to external users.

The CVSS score of 7.5 places this issue in the high‑severity range, indicating a significant risk if uncovered. However, the EPSS score is below 1 %, implying that real‑world exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers can call the dirGZActiveForm() endpoint directly from a web browser or via automated scripts by supplying a malicious forms-id parameter, without needing any authentication. The likely attack vector is unauthenticated access to the dirGZActiveForm() endpoint.