CVE-2026-80491

The SAMO Forms WordPress plugin through version 1.0.0 does not properly sanitize and escape user-supplied input before using it in SQL queries across several unauthenticated actions, meaning the vulnerable endpoints are reachable by any remote visitor without an account or login. An unauthenticated attacker can send crafted requests to inject arbitrary SQL, and the CVSS 3.1 score of 8.6 (with high confidentiality impact and changed scope) indicates the attacker can read sensitive database contents, potentially including form submissions, user data, and data from other tables or components reachable by the site's database user. Integrity and availability are rated as not impacted. Any WordPress site running SAMO Forms 1.0.0 or earlier is affected. No public proof-of-concept is known and the flaw is not on CISA's KEV list, but unauthenticated SQL injection in WordPress plugins is frequently weaponized once details circulate, so this should be treated as patch-urgently rather than monitored passively.

What to do: Check whether the developer has released a SAMO Forms version above 1.0.0 and upgrade immediately if so; the advisory specifies no patched version, so if no fix exists, deactivate and remove the plugin and migrate to a actively maintained form plugin. Audit web-server and database logs for anomalous queries, and verify that stored form-submission data (often containing PII) has not been accessed or exfiltrated. As an interim measure, a WAF with SQL injection signatures can block exploit attempts if the plugin cannot be removed right away.