EUVD-2026-51753
GHSA-987r-2928-h3pg
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Network-accessible admin panel (AV:N), low complexity post-auth (AC:L), administrator credentials required (PR:H), read-only database exfiltration with no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The GSheetConnector - CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 5.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. wp_unslash() strips magic-quote protection and sanitize_text_field() does not escape SQL metacharacters, leaving single quotes and other SQL metacharacters intact before the value is interpolated into the query.
AnalysisAI
SQL injection in the GSheetConnector CF7 Google Sheets Connector WordPress plugin (all versions through 5.2.1) enables authenticated administrators to exfiltrate arbitrary database contents via the unsanitized 's' search parameter. The root cause is a flawed sanitization chain: wp_unslash() removes magic-quote escaping while sanitize_text_field() fails to neutralize SQL metacharacters, leaving single quotes intact before direct query interpolation. No public exploit or CISA KEV listing has been identified at time of analysis, but the Wordfence disclosure includes direct source-code references confirming the vulnerable code paths in class-gs-cf7db-formEntryList.php and gs-cf7db.php.
Technical ContextAI
The vulnerable plugin (CPE: cpe:2.3:a:westerndeal:gsheetconnector_-_cf7_google_sheets_connector:*:*:*:*:*:*:*:*) is a WordPress add-on that bridges Contact Form 7 form submissions with Google Sheets. The vulnerability is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The flaw resides in the admin-facing form entry list view: the 's' parameter - used for searching form submissions - passes through wp_unslash() (which strips PHP magic-quote backslash escaping) and then sanitize_text_field() (which performs HTML/whitespace cleaning but explicitly does not escape SQL metacharacters). The resulting string is then interpolated directly into a SQL query without use of WordPress's $wpdb->prepare() or parameterized queries, violating WordPress coding standards. Affected code paths are confirmed at class-gs-cf7db-formEntryList.php lines 34 and 64, and gs-cf7db.php line 340 in the 5.1.7 tag, indicating the issue predates and persists through 5.2.1.
RemediationAI
Update to the patched version of GSheetConnector CF7 Google Sheets Connector immediately via the WordPress plugin dashboard; the fix corresponds to repository changeset 3628480 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3628480%40cf7-google-sheets-connector&new=3628480%40cf7-google-sheets-connector - verify the installed version exceeds 5.2.1 once an updated release is tagged. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/83455de5-4fb2-4782-8063-646d3daf29e5 should be monitored for the confirmed patched version number. If immediate upgrade is not possible, restrict the WordPress admin panel to known IP ranges using server-level access controls (e.g., nginx allow/deny directives or .htaccess restrictions on wp-admin) to reduce the exposure surface - note this does not eliminate the flaw but raises the bar for remote exploitation. Audit administrator-level accounts on the affected WordPress installation and remove any unnecessary admin accounts to minimize the pool of potential exploiters. A Web Application Firewall rule blocking SQL metacharacters in the 's' parameter on the affected admin page can serve as a compensating control, though WAF bypass is possible and should not substitute for patching.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today