What is the CVSS score of CVE-2026-42742?

CVE-2026-42742 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Views for WPForms are affected by CVE-2026-42742?

WPForms WordPress plugin versions 3.4.6 and earlier contain a blind SQL injection vulnerability that allows authenticated users with low-privilege accounts to extract sensitive database contents,…

Views for WPForms CVE-2026-42742

Q: How to fix or mitigate CVE-2026-42742?

Within 24 hours: Inventory all WordPress installations running WPForms and identify current plugin versions; document which versions are 3.4.6 or below. Within 7 days: restrict user account creation and limit WordPress user roles to minimum required privilege levels; disable WPForms Views feature if not actively used. Within 30 days: upgrade WPForms to the latest patched version once vendor releases a fix, or implement alternative form plugins if no patch timeline is provided by vendor.

EUVD-2026-29451 HIGH

SQL Injection (CWE-89)

2026-05-12 Patchstack

GHSA-7mfx-xwxr-fq6r

SQLi

8.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 11:31 vuln.today

CVE Published

May 12, 2026 - 11:02 nvd

HIGH 8.5

DescriptionNVD

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blind SQL Injection.This issue affects Views for WPForms: from n/a through <= 3.4.6.

AnalysisAI

Blind SQL injection in Views for WPForms WordPress plugin (versions ≤3.4.6) allows authenticated low-privilege attackers with network access to extract sensitive database contents. The vulnerability enables cross-scope compromise with high confidentiality impact and limited availability disruption. …

RemediationAI

Within 24 hours: Inventory all WordPress installations running WPForms and identify current plugin versions; document which versions are 3.4.6 or below. Within 7 days: restrict user account creation and limit WordPress user roles to minimum required privilege levels; disable WPForms Views feature if not actively used. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-42742 vulnerability details – vuln.today

Back