CVE-2026-80491

SAMO Forms <= 1.0.0 - Unauthenticated SQLi

Published Sep 12, 2026 CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Description

The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks.

Analysis

Technical impact

The SAMO Forms WordPress plugin through version 1.0.0 fails to properly sanitize and escape user input before incorporating it into SQL queries in several actions that do not require authentication. The flaw is a CWE-89 SQL injection, permitting attackers to inject arbitrary SQL statements, enabling them to read sensitive data, alter stored information, or delete database records. The vulnerability does not grant code execution, but the impact on confidentiality, integrity, and availability of the database is significant.

Affected Systems

All WordPress sites that have the SAMO Forms plugin installed at version 1.0.0 or earlier are affected.

Risk and Exploitability

The flaw can be exploited remotely with no authentication, and the associated CVSS score of 8.6 indicates a high damage potential. Although the EPSS score is less than 1%, the absence of authentication requirements and the high impact classifies the risk as high. The vulnerability is not present in the CISA KEV catalog; however,.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Unknown

SAMO Forms

unknown

Version	Status	Constraints
`0`	affected	≤ 1.0.0

No data.

Vendor Product Versions

Wordpress-extensions

Samo Forms

Version	Status	Scheme	Platform
`[0,1.0.0]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade SAMO Forms to the latest version.
If an upgrade cannot be performed immediately, use a web application firewall or server‑side rules to block or log suspicious SQL‑like input patterns on the plugin’s unauthenticated endpoints.
As a temporary measure, disable or require authentication for all features that submit data until a secure version is available.

Generated by OpenCVE AI on September 15, 2026 at 19:14 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.445% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://wpscan.com/vulnerability/765e7131-2eb4-41df-a1e0-05c8a89cb88c/

History

Nov 13, 2026 1:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress-extensions Wordpress-extensions samo Forms
Vendors & Products		Wordpress-extensions Wordpress-extensions samo Forms

Sep 12, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 12, 2026 8:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-89

Sep 12, 2026 6:15 AM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks.
Title		SAMO Forms <= 1.0.0 - Unauthenticated SQLi
References		https://wpscan.com/vulnerability/765e7131-2eb4-41df-a1e0-05c8a89cb88c/