EIP-2026-113646

This exploit demonstrates SQL injection vulnerabilities in the WordPress Contact Form Maker plugin (version 1.12.20 and below). It includes two PoC snippets that leverage time-based SQL injection via the `FormMakerSQLMapping_fmc` and `generete_csv_fmc` actions in WordPress admin-ajax.php.