Description

The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-12T06:16:25.403Z",
  "pubdate": "2026-09-12T06:16:25.403Z",
  "executiveSummary": "The SAMO Forms WordPress plugin through 1.0.0 is susceptible to unauthenticated SQL injection vulnerabilities.\nThe vulnerability arises from a failure to properly sanitize and escape user-supplied input before incorporating it into database queries.\nThis flaw allows remote, unauthenticated attackers to manipulate SQL queries, leading to unauthorized data exfiltration, database modification, or administrative privilege escalation within the WordPress environment.\nThe risk is critical as it requires no prior authentication or administrative access to exploit.\nImpact includes the potential compromise of the entire WordPress database, including sensitive user information and plugin configuration data.\nOrganizations relying on SAMO Forms 1.0.0 or earlier are at significant risk of unauthorized database access.",
  "technicalDetails": "The vulnerability is classified as an unauthenticated SQL injection (SQLi) flaw within the SAMO Forms WordPress plugin, affecting all versions up to and including 1.0.0.\nThe root cause is the improper handling of user-controllable input fields during the processing of unauthenticated actions. The plugin fails to utilize WordPress's built-in database abstraction and preparation methods, such as $wpdb->prepare(), when constructing SQL queries.\nConsequently, malicious SQL commands can be injected directly into the query structure through HTTP requests. Because these inputs are not sanitized or escaped, the database engine interprets the malicious input as part of the intended SQL command.\nThe attack flow begins with an unauthenticated attacker identifying vulnerable endpoints or parameters within the plugin's action handlers. By submitting crafted payloads—typically involving SQL syntax such as UNION SELECT, SLEEP(), or stacked queries—the attacker can break out of the intended query context.\nSuccessful exploitation allows the attacker to circumvent standard application logic. By manipulating the WHERE clause or appending new query statements, an attacker can extract sensitive data from the wp_users table, disclose hashed administrator passwords, or modify plugin configurations to facilitate further malicious activity.\nBecause the plugin facilitates these operations in an unauthenticated context, the attack requires no valid session or administrative privileges, making it highly accessible to automated vulnerability scanners and remote actors.\nThe exposure is network-based; any internet-facing installation of the SAMO Forms plugin is susceptible to exploitation via standard HTTP GET or POST requests.\nPost-exploitation impact is severe, potentially resulting in full administrative compromise of the WordPress site. An attacker may leverage the vulnerability to create new administrative accounts, alter site settings, or execute arbitrary code if the database environment allows for functions like FILE permissions or command execution extensions.\nThe technical failure persists across all features where user input is processed in SQL queries without explicit validation or parameterized query construction."
}