CVE-2025-7638: 
WordPress vulnerability analysis and mitigation

CVE-2025-7638 is a time-based SQL Injection vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin, affecting all versions up to and including 1.45.0. The flaw exists in the order_by parameter due to insufficient escaping and lack of proper SQL query preparation, allowing authenticated attackers with Administrator-level access to extract sensitive data from the database. It was published on July 18, 2025, and assigned a CVSS v3.1 base score of 4.9 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vulnerable code resides in library/model/class-form-entry-model.php (around line 2561), where the order_by parameter is incorporated into an SQL query without adequate escaping or use of prepared statements (Wordfence, WordPress Trac). The attack vector is network-based, requires no user interaction, but does require high privileges (Administrator-level authentication). Exploitation takes the form of time-based blind SQL injection, where an attacker appends malicious SQL clauses to infer database contents through response timing differences.

Successful exploitation allows an authenticated administrator-level attacker to extract sensitive information from the WordPress database, potentially including user credentials, personal data stored in form submissions, configuration details, and other confidential records. The vulnerability has no integrity or availability impact (confidentiality impact is rated High), meaning attackers cannot modify or delete data through this vector alone. However, database credential exposure could enable further lateral movement or privilege escalation within the hosting environment (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.024% (0.000240), indicating a low probability of near-term exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for Administrator-level authentication, significantly limiting the attacker pool.

1. Authentication: Obtain or compromise WordPress administrator credentials for the target site running Forminator Forms ≤ 1.45.0.
2. Identify the vulnerable endpoint: Navigate to the Forminator form entries management page in the WordPress admin panel, which triggers queries using the order_by parameter.
3. Inject time-based payload: Manipulate the order_by parameter in the HTTP request to include a time-based SQL injection payload (e.g., appending IF(1=1, SLEEP(5), 0) or similar DBMS-specific timing constructs).
4. Infer data via timing: Observe response delays to confirm injection success, then craft iterative payloads to extract database contents character by character (e.g., enumerating table names, user hashes, or form submission data).
5. Exfiltrate sensitive data: Use automated tools such as sqlmap with session cookies to systematically dump the WordPress database, targeting tables like wp_users and Forminator-specific entry tables (Wordfence, WordPress Trac).

• Network: Unusual or repeated HTTP requests to WordPress admin endpoints associated with Forminator form entry management, particularly with anomalous order_by parameter values containing SQL keywords (e.g., SLEEP, IF, BENCHMARK, WAITFOR).
• Logs: WordPress or web server access logs showing requests with encoded or unusual characters in the order_by parameter; requests with notably delayed response times (indicative of SLEEP-based payloads).
• Database: Unexpected or high-volume database query activity originating from the WordPress application user, particularly slow queries logged in the MySQL slow query log involving Forminator entry tables.

Users should update the Forminator Forms plugin to a version beyond 1.45.0 that includes a fix for this vulnerability. As an interim measure, restrict administrator access to trusted users only and consider using a web application firewall (WAF) rule to block requests containing SQL injection patterns in the order_by parameter. Monitor the Wordfence advisory and the WordPress plugin repository for the availability of a patched release (Wordfence).

The vulnerability was reported and assigned by Wordfence, which published the advisory on July 18, 2025. Sucuri noted it in their July 2025 WordPress vulnerability patch roundup, indicating routine coverage within the WordPress security community (Sucuri Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.