What is the CVSS score of CVE-2025-46252?

CVE-2025-46252 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Message Filter CF7 are affected by CVE-2025-46252?

Contact Form 7's Message Filter (versions through 1.6.3.2) contains a SQL injection vulnerability that could allow administrators to access or modify the entire WordPress database, creating direct…

How to fix or mitigate CVE-2025-46252?

Within 24 hours, audit all WordPress administrator accounts on systems running Contact Form 7 version 1.6.3.2 or earlier to identify current privilege holders and review when access was last validated. Within 7 days, implement access restrictions by removing unnecessary administrator roles and disabling the Message Filter component if not actively required for business operations. Within 30 days, monitor Patchstack and Contact Form 7 release channels for an official security patch and plan immediate testing and deployment; if no patch emerges within 60 days, evaluate alternative form plugins with active security maintenance.

Message Filter CF7 CVE-2025-46252

HIGH

SQL Injection (CWE-89)

2025-04-22 audit@patchstack.com

WordPress SQLi Message Filter For Contact Form 7 Wordpress Plugin Kofimokome

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Admin credentials gate access (PR:H); once authenticated, exploitation is straightforward (AC:L, AV:N) with full database CIA impact and no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 24, 2026 - 17:48 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 24, 2026 - 17:43 vuln.today

v2 (cvss_changed)

CVSS changed

Aug 24, 2026 - 17:22 NVD

7.6 (HIGH) 7.2 (HIGH)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.2 (HIGH) 7.6 (HIGH)

Analysis Generated

Mar 28, 2026 - 18:38 vuln.today

CVE Published

Apr 22, 2025 - 10:15 nvd

HIGH 7.2

DescriptionNVD

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kofimokome Message Filter for Contact Form 7 allows SQL Injection. This issue affects Message Filter for Contact Form 7: from n/a through 1.6.3.2.

AnalysisAI

SQL injection in the Message Filter for Contact Form 7 WordPress plugin (versions through 1.6.3.2) enables authenticated high-privileged users to manipulate backend database queries, potentially exposing or modifying the entire WordPress database. Discovered and reported by Patchstack (audit@patchstack.com), the flaw carries a CVSS score of 7.2, with the PR:H metric confirming that exploitation is gated behind administrator-level credentials. No public exploit code and no active exploitation have been identified at time of analysis.

Technical ContextAI

The affected component is the kofimokome Message Filter for Contact Form 7 WordPress plugin (CPE: cpe:2.3:a:kofimokome:message_filter_for_contact_form_7:*:*:*:*:*:wordpress:*:*), a third-party extension for the widely-used Contact Form 7 form plugin. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause as unsanitized or unparameterized user-supplied input being concatenated directly into SQL queries against the WordPress MySQL/MariaDB database. This class of flaw arises when prepared statements or the WordPress $wpdb->prepare() abstraction are not consistently applied, allowing an attacker to alter query logic through crafted input values submitted via the plugin's administrative interface.

RemediationAI

Update the Message Filter for Contact Form 7 plugin to the version released after 1.6.3.2; a specific patched version number is not confirmed in available intelligence - consult the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/cf7-message-filter/vulnerability/wordpress-message-filter-for-contact-form-7-plugin-1-6-3-2-sql-injection-vulnerability for the current fixed release. If an immediate update is not possible, restrict WordPress administrator access to trusted personnel only and enforce multi-factor authentication on all admin accounts to reduce the likelihood of credential compromise that would enable exploitation. Additionally, consider deploying a WordPress-aware web application firewall (WAF) rule targeting SQL injection patterns in admin-facing plugin endpoints as a compensating control, noting that WAF rules may produce false positives and are not a substitute for patching.