The Easy Form Builder plugin for WordPress fails to properly neutralize special characters used in SQL commands, allowing an attacker to insert arbitrary SQL through form inputs. This flaw enables blind SQL injection, which can be used to extract sensitive information or modify database contents without immediate visible error responses. The impact manifests as unauthorized data disclosure and potential manipulation of the site’s data integrity.

The vulnerability affects the WordPress Easy Form Builder plugin provided by hassantafreshi. All released versions from the first version through 4.0.6 are susceptible; the exact lower bound is unspecified but the patch applies to any version up to and including 4.0.6.

With a CVSS score of 9.3, the flaw is considered critical. The EPSS score is not available, so the current probability of exploitation cannot be quantified. It is not listed in CISA’s KEV catalog. Attackers can exploit the issue remotely by submitting crafted input via any exposed form provided by the plugin. No additional credentials or privileges are required beyond the ability to interact with the form.