The Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin suffers from a time-based SQL Injection vulnerability via the 'order_by' parameter. Due to inadequate escaping and preparation of this user-supplied parameter, authenticated administrators can append malicious SQL code to existing queries. This vulnerability allows unauthorized reading of sensitive database information without impacting data integrity or availability. The CVSS 3.1 base score is 4.9 (medium), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality impact.

Successful exploitation enables an attacker with administrator privileges to extract sensitive information from the database by injecting additional SQL commands. The vulnerability does not affect data integrity or availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to the 'order_by' parameter. Avoid using vulnerable versions of the plugin where possible.