CVE-2025-6783 identifies an SQL Injection vulnerability in the GoZen Forms plugin for WordPress, specifically in the 'forms-id' parameter handled by the emdedSc() function. The issue stems from improper neutralization of special elements in SQL commands (CWE-89), where user-supplied input is not sufficiently escaped or prepared before being incorporated into SQL queries. This allows unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive data from the backend database. The vulnerability affects all versions up to and including 1.1.5. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information stored in the database. The attacker does not require authentication and can remotely execute SQL injection attacks via the vulnerable parameter. The integrity and availability of the database are not impacted according to the CVSS vector, but confidentiality is rated high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable functionality or plugin. Applying web application firewall (WAF) rules that detect and block SQL injection attempts targeting the 'forms-id' parameter may provide temporary mitigation.