CVE-2026-80491: SAMO Forms <= 1.0.0 - Unauthenticated SQLi

Q: Who can exploit this issue?

Unauthenticated attackers can exploit the affected actions; no WordPress account or prior authentication is required.

Q: Which installations are affected?

SAMO Forms versions through 1.0.0 are affected. The issue is present in several unauthenticated actions, so installations exposing those plugin actions are at risk.

Q: What can an attacker do?

An attacker can perform SQL injection by supplying crafted input to vulnerable unauthenticated actions, potentially causing unintended database queries to run.

Published Sep 12, 2026

Updated

The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks.

Affected Software

1 affected component

WordPress plugin SAMO Forms<=1.0.0

Event History

Sep 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated attackers can exploit the affected actions; no WordPress account or prior authentication is required.

Which installations are affected?

SAMO Forms versions through 1.0.0 are affected. The issue is present in several unauthenticated actions, so installations exposing those plugin actions are at risk.

What can an attacker do?

An attacker can perform SQL injection by supplying crafted input to vulnerable unauthenticated actions, potentially causing unintended database queries to run.