What is GHSA-pm55-93cr-mxp6?

GHSA-pm55-93cr-mxp6 is a security advisory published by GitHub Security Advisories with High severity. WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow...

Which CVE IDs does GHSA-pm55-93cr-mxp6 cover?

GHSA-pm55-93cr-mxp6 covers the following CVE IDs: CVE-2018-25347. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pm55-93cr-mxp6?

GHSA-pm55-93cr-mxp6 has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

GHSA-pm55-93cr-mxp6HighCVSS 7.1

WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow...

Vendor

GitHub Security Advisories

Published

May 26, 2026

Last Modified

May 26, 2026

🔗 CVE IDs covered (1)

CVE-2018-25347 →

📋 Description

WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters to extract sensitive database information or escalate privileges.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2018-25347
https://wordpress.org/plugins/contact-form-maker
https://www.exploit-db.com/exploits/44854
https://www.vulncheck.com/advisories/wordpress-contact-form-maker-plugin-sql-injection
https://github.com/advisories/GHSA-pm55-93cr-mxp6