EUVD-2026-85467
GHSA-m82m-g64v-2h52
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor-level WordPress account
-
DeliverySend crafted request to Mollie Forms endpoint
-
ExploitInject SQL into unsanitized parameter
-
ExecutionQuery executes against site database
-
ImpactExtract credentials and payment/user data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with at least the Contributor role (PR:L) on a site running the Mollie Forms plugin version 2.11.0 or earlier; no user interaction is needed (UI:N) and the endpoint is network-reachable (AV:N). Exploitation is limited by the need to first acquire Contributor credentials - sites that do not permit self-registration or that restrict Contributor accounts to trusted users substantially reduce exposure. No fixed version is stated in the available data, so remediation status cannot be confirmed. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, score 8.5) describes a network-reachable, low-complexity SQL injection requiring only Contributor-level authentication (PR:L) with no user interaction. This is credible for a WordPress plugin flaw: Contributor is a low-trust role that many WordPress sites grant to semi-untrusted users, so the authentication barrier is modest. However, the raw score should be read with caution - there is no EPSS score, no CISA KEV listing, and no public POC provided, so there is no evidence of active or imminent exploitation. No SSVC decision data was supplied either. The score is also driven partly by S:C (scope change) and C:H; while SQLi plausibly yields full database read (C:H), the S:C and A:L assignments are debatable - a classic SQLi confined to the WordPress DB is often scored S:U, which would lower the composite. Net: this is a genuine, easily exploitable vulnerability where an attacker holds a low-priv account, but the absence of exploitation signals (no KEV, no POC, no EPSS) places it as a patch-soon issue rather than an emergency, and the requirement for a valid Contributor account materially narrows the exposed population. |
| Exploit ScenarioDerived | An attacker who has registered or obtained a WordPress Contributor account on a site running Mollie Forms <= 2.11.0 submits a crafted request to an affected plugin endpoint containing malicious SQL in a parameter. The unsanitized input is concatenated into a database query, allowing the attacker to extract sensitive data such as user credentials, session tokens, or payment/order records. No public exploit code was identified at time of analysis, and exploitation requires the attacker to first hold valid Contributor credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
SQL injection in the Mollie Forms WordPress plugin (versions up to and including 2.11.0) lets a remote attacker who holds an authenticated Contributor-level account on the target site inject arbitrary SQL through plugin-supplied input, potentially exposing sensitive data stored in the WordPress database. The issue is network-reachable with low attack complexity and requires no user interaction, but exploitation is gated by the need to first obtain Contributor credentials, so sites that disable open registration or tightly control Contributor accounts are substantially less exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no vendor-released fixed version is stated in the available data. Reported by Patchstack and tracked as EUVD-2026-85467; the independent assessment rates the impact as high confidentiality with limited integrity and availability effects under an unchanged-scope vector.
RemediationAI
No vendor-released patch is identified in the available data and no fixed version is stated, so remediation status cannot be confirmed - treat this as 'No vendor-released patch identified at time of analysis' and verify directly against the plugin's WordPress.org repository and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/mollie-forms/vulnerability/wordpress-mollie-forms-plugin-2-11-0-sql-injection-vulnerability?_s_id=cve) before assuming an update exists. If no patched release is available, the most effective compensating controls are to deactivate and remove the Mollie Forms plugin where it is not business-critical (side effect: loss of form/payment functionality), or, if it must stay active, to eliminate the Contributor-role exposure by disabling open user registration (Settings > General > Membership), disabling any plugins that allow front-end account creation, and reviewing all existing Contributor accounts so they are limited to genuinely trusted users - this directly blocks the PR:L precondition but degrades self-service onboarding. Additional layered measures include deploying a WAF rule set that blocks SQL metacharacters and known injection patterns on requests to the plugin's endpoints (side effect: possible false positives on legitimate form submissions and no protection against authenticated abuse from allowed IPs), restricting wp-admin/admin-ajax.php POST traffic to known-good sources where the architecture allows it, and monitoring database and web logs for anomalous query strings referencing the plugin's form or submission handlers. Because the assessed impact includes high confidentiality loss, database backups and a credential/data exposure review should accompany any cleanup, and note that no public exploit code was identified at time of analysis, so this is a hardening exercise rather than active incident response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Mollie Forms is a third-party WordPress plugin (vendor namespace nick_van_wobbie, CPE cpe:2.3:a:nick_van_wobbie:mollie_forms:*:*:*:*:*:*:*:*) that provides payment/form handling and stores submission data in the WordPress database. The root cause class is CWE-89 (SQL Injection): user-controlled input is incorporated into a database query without proper parameterization, escaping, or use of the WordPress $wpdb->prepare() abstraction, allowing a caller to alter the query's structure. Because WordPress treats the Contributor role as the lowest authenticated role that can create and manage its own content, an account at that level is sufficient to reach the vulnerable code path, which is why the vector carries PR:L. The CVSS 3.1 submission accompanying the CVE (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, score 8.5) claims a scope change, whereas the independent assessment uses S:U (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) - the practical difference is that the assessed vector does not assert the vulnerability crosses a security authority boundary, and rates integrity and availability impact as Low rather than None/Low. Both readings agree on full network reachability, low complexity, Contributor-level authentication, and no required user interaction. Authentication requirements are confirmed unauthenticated? No: the vector contains PR:L, so exploitation is authenticated and requires at least the Contributor role.
Know when Mollie Forms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Contributor auth gives PR:L; SQLi yields full DB read (C:H) with limited write/DoS potential (I:L/A:L); scored S:U as the impact stays within the same WordPress database.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.
Executive ViewAI
The Mollie Forms WordPress plugin (versions up to and including 2.11.0) is affected by a SQL injection vulnerability that could enable an attacker with a Contributor-level account to extract sensitive data from the site's database. No public exploit identified at time of analysis, but organizations using this plugin are at risk of data exposure, which could lead to regulatory penalties and reputational damage, especially if Contributor accounts are easily obtainable through open registration or weak access controls.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Contributor account creation and capabilities; deploy WAF rules to detect and block SQL injection attempts; monitor database activity for anomalous queries; and consider temporarily disabling the Mollie Forms plugin (versions up to and including 2.11.0) until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Mollie Forms
View allThe Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on
The Mollie Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,
The Mollie Forms plugin for WordPress is vulnerable to unauthorized post or page duplication due to a missing capability
Exploit-DB