CVE-2026-93773 in Mollie Forms Plugin
Summary
by MITRE • 09/23/2026
Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified within Mollie Forms plugin versions up to and including 2.11.0 represents a critical security flaw classified as an injection attack, specifically falling under the Common Weakness Enumeration category CWE-89 for SQL Injection. This issue arises from insufficient sanitization of user-supplied input data associated with contributor roles or permissions within the WordPress environment. When administrators or users interact with the plugin to manage form submissions or contributor settings, specific parameters are passed directly into database queries without adequate validation or parameterization. An attacker who possesses valid credentials for a low-privilege account can exploit this weakness by injecting malicious SQL code through these input fields. The core technical flaw lies in the failure to properly escape special characters such as single quotes and semicolons before they are processed by the backend database engine, allowing the injected commands to alter the structure or intent of legitimate queries.
The operational impact of this vulnerability is significant because it allows for unauthorized data access and potential manipulation of the underlying WordPress database. By leveraging SQL injection techniques, an attacker can extract sensitive information stored in the database, including user credentials, personal identifiable information associated with form submissions, and configuration details that could facilitate further attacks. In more severe scenarios, depending on the specific database permissions configured for the web application, this flaw could potentially lead to remote code execution or complete compromise of the hosting environment. The ability to bypass authentication mechanisms or escalate privileges within the WordPress ecosystem makes this a high-severity issue that threatens the integrity and confidentiality of data managed through the Mollie Forms plugin.
From an offensive security perspective, this vulnerability aligns with techniques documented in the MITRE ATT&CK framework, particularly those related to SQL injection attacks used for credential harvesting or unauthorized access. The attack vector typically involves manipulating HTTP requests sent during form processing operations where contributor details are updated or retrieved. Security analysts should note that while the initial entry point requires some level of authenticated access, the low barrier to entry combined with the high impact on data integrity classifies this as a serious risk for organizations relying on this plugin for payment-related forms and customer interactions.
To mitigate this vulnerability, immediate action is required by updating the Mollie Forms plugin to version 2.11.1 or later, where the developers have implemented proper input sanitization and prepared statement usage to prevent SQL injection attacks. Administrators should also ensure that their WordPress installations are fully patched and adhere to least privilege principles for database users associated with the web application. Regular security audits and code reviews focusing on data handling practices can further reduce the risk of similar vulnerabilities in custom plugins or themes, ensuring robust protection against injection-based threats across the digital infrastructure.