The Forminator plugin contains a time‑based SQL injection flaw in the order_by parameter. The value is not properly escaped and the existing SQL query is not sufficiently prepared, allowing injected SQL to be appended to the original statement. Attackers who are authenticated with Administrator or higher privileges can exploit this to run arbitrary queries and extract sensitive data from the WordPress database.

WordPress sites that use the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin, versions 1.45.0 and all earlier releases.

The vulnerability has a CVSS score of 4.9, indicating moderate severity, and an EPSS score of less than 1%, meaning the probability of exploitation is low. The flaw is not listed in the CISA KEV catalog. Since only authenticated users with Administrator level access can trigger the injection, exploitation requires local administrative control of the site rather than remote access. The impact is limited to the scope of the attacker’s WordPress database but can expose passwords, user tokens, and other confidential information.