The Mollie Forms plugin contains a critical SQL injection vulnerability that allows authenticated contributors to perform unauthorized database operations.

This vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89). It allows an authenticated user with contributor-level privileges to inject malicious SQL commands into the application database.

Successful exploitation of this flaw could allow an attacker to extract sensitive information from the database, potentially leading to unauthorized data exposure. Given the CVSS score of 8.5, this high-severity vulnerability poses a significant risk to the integrity and confidentiality of the affected WordPress site.

Immediate Action: Update the Mollie Forms plugin to version 2.11.1 or the latest available version provided by the vendor.

Proactive Monitoring: Review database query logs for unusual activity or signs of unauthorized SQL syntax, particularly from accounts with contributor-level access.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to provide temporary protection while updates are being staged.

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

The vulnerability represents a high-risk security flaw that can be leveraged by authenticated users to compromise backend data. Administrators should prioritize updating the Mollie Forms plugin to the patched version immediately to eliminate the injection vector and secure the application database.