A view injection flaw in the Aman Views for WPForms WordPress plugin allows an attacker to perform blind SQL injection through improperly sanitized input. This flaw can let a remote attacker extract or manipulate data from the site’s database, compromising confidentiality and integrity of stored information. The weakness is identified as CWE‑89.

The vulnerability affects the Aman Views for WPForms plugin version 3.4.6 and all earlier releases. Any WordPress installation that has this plugin enabled is at risk until an update is applied or the plugin is removed.

The CVSS score of 8.5 indicates high severity. EPSS data is currently unavailable, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote word‑press site user or attacker who can submit or modify form data processed by the plugin. Based on the description, it is inferred that exploitation requires only that the plugin is active; no additional privileges are required.