The identified weakness lies in the GoZen Forms plugin for WordPress, where the emdedSc() function fails to escape the user supplied 'forms-id' parameter and does not prepare the surrounding SQL query. Because of this flaw an attacker can insert arbitrary SQL statements. The result is an unauthenticated SQL Injection that permits reading of database tables, potentially revealing user data, configuration, and other confidential information. The vulnerability directly compromises database confidentiality.

The flaw affects all installations of the GoZen Forms plugin version 1.1.5 or older, including the base release provided by optinlyhq. WordPress sites running these versions are at risk regardless of their overall configuration, as the plugin is loaded by default and the function is accessible to all visitors.

The CVSS score of 7.5 indicates a high severity for exploitation. The EPSS score is below 1 %, showing a very low current probability of usage in the wild, and it is not listed in the CISA KEV catalog. Nonetheless, because the attack does not require any authentication, the potential impact is significant if an attacker can reach the endpoint. The expected attack vector is a crafted HTTP request containing the 'forms-id' parameter. Once the injection succeeds, the attacker gains read access to the database, which can have business‑critical consequences.