SQL Injection Vulnerability in Form Vibes Database Manager for WordPress
CVE-2025-13409

4.9MEDIUM

Key Information:

Vendor: WordPress
Status: Form Vibes – Database Manager For Forms
Vendor: CVE Published:; 6 January 2026

What is CVE-2025-13409?

The Form Vibes – Database Manager for Forms plugin for WordPress is susceptible to SQL Injection due to inadequate escaping of user-supplied parameters in the 'params' parameter. This vulnerability affects all versions up to and including 1.4.13. Authenticated attackers with Administrator-level access can exploit this flaw to inject malicious SQL queries that manipulate existing database queries, potentially exposing sensitive information stored within the database.

Affected Version(s)

Form Vibes – Database Manager for Forms * <= 1.4.13

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/form-vibes/tag...

CVSS V3.1

Score:

4.9

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Jan 6, 2026
Vulnerability Reserved
Nov 19, 2025

Credit

tmrswrr

JSON