CVE-2025-13409 is an SQL Injection vulnerability in the Form Vibes – Database Manager for Forms WordPress plugin affecting all versions up to 1.4.13. The issue arises from improper neutralization of special elements in the 'params' parameter, which is insufficiently escaped and not properly prepared in SQL queries. Authenticated attackers with Administrator privileges can exploit this to append malicious SQL commands to existing queries, potentially extracting sensitive data from the database. The vulnerability has a CVSS 3.1 base score of 4.9, reflecting medium severity with network attack vector, low attack complexity, and requiring high privileges but no user interaction.

An attacker with Administrator-level access can exploit this vulnerability to perform SQL Injection attacks, enabling unauthorized extraction of sensitive information from the database. The vulnerability does not directly impact integrity or availability according to the CVSS vector but compromises confidentiality. No evidence of exploitation in the wild is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the plugin. Avoid using vulnerable versions of the plugin where possible.