Cp Contact Form With Paypal CVE-2026-32433

Requires valid user login credentials to CP Contact Form with Paypal version <= 1.3.61. SQL injection occurs in contact form input fields processed without parameterized queries. Authentication necessary; no unauthenticated remote exploitation.

The CVSS 3.1 score of 8.5 (High) reflects network-based attack vector with low complexity requiring low privileges and no user interaction. The scope change (S:C) indicates potential impact beyond the vulnerable component, suggesting possible compromise of other applications on shared hosting. However, the absence from CISA's KEV catalog and lack of public exploits suggest this is not currently being actively exploited. Without EPSS data, we cannot assess the statistical likelihood of exploitation. The combination of authentication requirement (PR:L) and blind injection nature makes this less attractive to opportunistic attackers compared to unauthenticated SQL injections, though the scope change elevates concern for shared hosting environments.

An attacker with a low-privileged WordPress account (such as a subscriber or contributor) crafts malicious SQL payloads within form submissions or plugin parameters to extract database contents through blind injection techniques. By observing differences in application response times or error behaviors, the attacker systematically extracts sensitive data like admin credentials or payment information. No public proof-of-concept exists, requiring attackers to develop custom exploitation techniques.