CVE-2025-6782 identifies an SQL Injection vulnerability in the GoZen Forms plugin for WordPress, specifically in the handling of the 'forms-id' parameter within the dirGZActiveForm() function. The plugin versions up to and including 1.1.5 do not properly escape user-supplied input nor use prepared statements, enabling attackers to append arbitrary SQL commands to existing queries. This vulnerability is exploitable without authentication and can be used to extract sensitive data from the underlying database. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, potentially extracting sensitive information from the database. The integrity and availability of the system are not directly impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or restricting access to the vulnerable functionality to mitigate risk.