Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Database for Contact Form 7 plugin - SQL injection risk for admins

CVE-2026-14872 · published 3 months ago
Summary

A security flaw in the Database for Contact Form 7 plugin affects administrators who can create forms. This issue allows attackers to potentially access sensitive data. Update the plugin to version 1.5.5 or later to fix the problem.

What to do
  • Update unknown database for contact form 7, wpforms, elementor forms to version 1.5.5 or later.
Affected software
VendorProductAffected versions
unknown database for contact form 7, wpforms, elementor forms < 1.5.5
Original advisory text
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Inject...
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default but can be delegated to lower privileged roles.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published4 Aug 2026
Updated4 Nov 2026
First seen4 Aug 2026
Sources
CVE-2026-14872 · NVD
CVE-2026-14872 · MITRE
Track software like this
Free during beta