Time-based SQL Injection in iATS Online Forms Plugin for WordPress

CVE-2025-9441

What is CVE-2025-9441?

The iATS Online Forms plugin for WordPress is susceptible to a time-based SQL injection through the 'order' parameter. This vulnerability arises from inadequate escaping of user-supplied data and insufficient preparation of existing SQL queries. Authenticated users with Contributor-level access or higher can exploit this flaw to append malicious SQL queries, potentially leading to unauthorized access to sensitive database information.

References