The iATS Online Forms plugin for WordPress contains a time‑based SQL injection in the order parameter. The flaw exists in every version up to and including 1.2. Because the plugin fails to escape or properly prepare the parameter, an authenticated user with Contributor or higher permissions can append arbitrary SQL statements to an existing query. This enables the attacker to read confidential data from the database, such as user credentials, order details, or other stored information. The weakness corresponds to CWE‑89 injection.

WordPress sites that rely on the iatspaymentsdev iATS Online Forms plugin with any version 1.2 or earlier. No other versions or products are affected according to the CNA information.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers must first authenticate with at least Contributor privileges, then send a crafted request containing a malicious order parameter. Once satisfied, the attacker can retrieve arbitrary data from the database. No remote code execution or privilege escalation beyond what the authenticated role permits is possible with this flaw.