The Form Vibes plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) in the 'fv_export_data' parameter due to insufficient escaping and lack of proper query preparation. Authenticated attackers with at least Subscriber-level privileges can append malicious SQL commands to existing queries, potentially extracting sensitive data from the database. This vulnerability affects all plugin versions up to 1.4.10. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and privileges required. No patch or remediation details are currently available.

Successful exploitation allows authenticated users with Subscriber-level access or above to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information, full compromise of database integrity, and disruption of availability. The vulnerability can be exploited remotely over the network without user interaction, increasing the risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges to the minimum necessary and monitor for suspicious activity related to the 'fv_export_data' parameter. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the vendor for patch availability.