EUVD-2026-52587
GHSA-j65x-2556-f67f
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Network-accessible WordPress admin UI; PR:H reflects required authenticated capability; S:C and C:H capture full database read beyond plugin scope; no write or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default but can be delegated to lower privileged roles.
AnalysisAI
SQL injection in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin (versions before 1.5.5) exposes the underlying WordPress database to unauthorized read access by any user holding a specific capability that defaults to administrators but can be explicitly delegated to lower-privileged roles. The CVSS scope-change rating (S:C/C:H) reflects that a successful injection reaches beyond the plugin itself into the shared WordPress database, potentially exposing all stored form submissions, user data, and other sensitive records. Publicly available exploit code exists per WPScan; however, EPSS at 0.16% (5th percentile) and absence from CISA KEV indicate no confirmed widespread active exploitation at time of analysis.
Technical ContextAI
The affected plugin aggregates form submission data from three popular WordPress form builders - Contact Form 7, WPforms, and Elementor forms - into a centralized WordPress database table for storage and review. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning at least one user-controllable parameter is interpolated directly into a SQL query without adequate sanitization or parameterized query usage. The WordPress environment uses MySQL/MariaDB as its backend, so a successful injection can interact with all tables accessible to the WordPress database user - potentially including wp_users, wp_options, and any plugin or theme tables. The CPE string (cpe:2.3:a:unknown:database_for_contact_form_7,_wpforms,_elementor_forms:*:*:*:*:*:*:*:*) covers all versions prior to 1.5.5. The vulnerability was discovered and reported by WPScan, a specialized WordPress security scanner.
RemediationAI
The primary fix is to upgrade the 'Database for Contact Form 7, WPforms, Elementor forms' plugin to version 1.5.5 or later, which is available from the WordPress plugin repository and confirmed by the vendor advisory referenced via WPScan at https://wpscan.com/vulnerability/557414c2-70b9-4466-8727-d8a2c9a8a502/. Site administrators should update immediately and verify the installed version in the WordPress dashboard under Plugins. As an interim compensating control if immediate upgrade is not possible, administrators should audit which user roles have been granted the specific form-database management capability and revoke delegation from any non-administrator roles - this narrows the exploitable attacker pool to true site admins. Additionally, deploying a WordPress-aware Web Application Firewall (WAF) rule for SQL injection patterns (e.g., via Wordfence or Cloudflare WAF) can reduce exploitation success, though this is not a substitute for patching. No evidence of incomplete patch coverage or bypass for version 1.5.5 has been identified.
We need to generate a JSON object with the specified fields, synthesizing all provided data about CVE-2026-14870. First
PHP object injection in the 'Database for Contact Form 7, WPforms, Elementor forms' WordPress plugin (all versions befor
A vulnerability in CRM Perks Contact Form Entries contact-form-entries.3.0. Rated high severity (CVSS 8.5), this vulnera
Arbitrary file deletion in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin (versions ≤1.5.1)
The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validatio
Arbitrary file copy in the Database for Contact Form 7, WPforms, Elementor Forms WordPress plugin (versions ≤ 1.5.1) exp
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for HubSpot and Contact Form
Authenticated attackers with Contributor-level access or above can extract all form submissions from the Database for Co
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today