Mollie Forms CVE-2026-93773

Requires an authenticated WordPress account with at least the Contributor role (PR:L) on a site running the Mollie Forms plugin version 2.11.0 or earlier; no user interaction is needed (UI:N) and the endpoint is network-reachable (AV:N). Exploitation is limited by the need to first acquire Contributor credentials - sites that do not permit self-registration or that restrict Contributor accounts to trusted users substantially reduce exposure. No fixed version is stated in the available data, so remediation status cannot be confirmed.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, score 8.5) describes a network-reachable, low-complexity SQL injection requiring only Contributor-level authentication (PR:L) with no user interaction. This is credible for a WordPress plugin flaw: Contributor is a low-trust role that many WordPress sites grant to semi-untrusted users, so the authentication barrier is modest. However, the raw score should be read with caution - there is no EPSS score, no CISA KEV listing, and no public POC provided, so there is no evidence of active or imminent exploitation. No SSVC decision data was supplied either. The score is also driven partly by S:C (scope change) and C:H; while SQLi plausibly yields full database read (C:H), the S:C and A:L assignments are debatable - a classic SQLi confined to the WordPress DB is often scored S:U, which would lower the composite. Net: this is a genuine, easily exploitable vulnerability where an attacker holds a low-priv account, but the absence of exploitation signals (no KEV, no POC, no EPSS) places it as a patch-soon issue rather than an emergency, and the requirement for a valid Contributor account materially narrows the exposed population.

An attacker who has registered or obtained a WordPress Contributor account on a site running Mollie Forms <= 2.11.0 submits a crafted request to an affected plugin endpoint containing malicious SQL in a parameter. The unsanitized input is concatenated into a database query, allowing the attacker to extract sensitive data such as user credentials, session tokens, or payment/order records. No public exploit code was identified at time of analysis, and exploitation requires the attacker to first hold valid Contributor credentials.