CVE-2014-9309

The Formidable Form Builder plugin for WordPress contains a blind SQL injection vulnerability in versions up to 1.07.11 affecting the 'orderby' parameter, which arises from improper escaping of user input and inadequately prepared SQL statements. Authenticated users with subscriber-level access or higher can exploit this flaw to inject additional SQL commands into existing queries, enabling them to retrieve sensitive data from the database.

Based on public CVE data (MITRE/NVD).