What is the CVSS score of CVE-2026-61955?

CVE-2026-61955 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of Persian Gravity Forms are affected by CVE-2026-61955?

The Persian Gravity Forms WordPress plugin (versions 3.0.2 and earlier) contains a SQL injection vulnerability that allows administrators with compromised credentials or malicious insiders to…

How to fix or mitigate CVE-2026-61955?

Within 24 hours, audit all WordPress installations to identify those running Persian Gravity Forms and document installed versions. Within 7 days, restrict WordPress administrative account access to essential personnel only, enable database-level query logging and access controls, and monitor Patchstack security advisories for patch availability. Within 30 days, apply the vendor-released patch immediately upon availability, or if patch remains unavailable, disable the plugin and migrate form functionality to an alternative vetted plugin with security testing completed.

Persian Gravity Forms CVE-2026-61955

EUVD-2026-43435 HIGH

SQL Injection (CWE-89)

2026-07-13 Patchstack

WordPress SQLi Wordpress Plugin

7.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

4.9 MEDIUM

Network-reachable blind SQLi needs an existing high-privilege account (PR:H, AC:L); read-oriented data disclosure gives C:H with I:N/A:N, and scope stays unchanged absent evidence of cross-system impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:21 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویتی فرم فارسی persian-gravity-forms allows Blind SQL Injection.This issue affects گرویتی فرم فارسی: from n/a through <= 3.0.2.

AnalysisAI

Blind SQL injection in the persian-gravity-forms WordPress plugin (گرویتی فرم فارسی) affects all versions up to and including 3.0.2, allowing a high-privilege authenticated attacker to inject arbitrary SQL through unsanitized input and blindly extract database contents. The flaw was reported by Patchstack and carries a CVSS 7.6 due to a changed scope and high confidentiality impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is persian-gravity-forms, a Persian (Farsi) localization/add-on package for the Gravity Forms plugin ecosystem on WordPress, running as PHP against a MySQL/MariaDB backend (CPE cpe:2.3:a:hannan:گرویتی_فرم_فارسی). The root cause is CWE-89, Improper Neutralization of Special Elements used in an SQL Command, meaning user-controllable input is concatenated into a SQL query without parameterization or proper escaping. Because exploitation is 'blind,' the query returns no direct data or errors to the attacker, so extraction relies on boolean- or time-based inference - the attacker observes differing responses or response delays to reconstruct data one bit at a time.

RemediationAI

No vendor-released patch version was identified in the provided data, so the exact fixed release is not confirmed - consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/persian-gravity-forms/vulnerability/wordpress-ro-t-frm-f-rs-plugin-3-0-2-sql-injection-vulnerability?_s_id=cve) for any release after 3.0.2 and upgrade to it as the primary fix. Until a confirmed patched version is available, compensating controls include: tightly restricting which WordPress accounts hold administrator or other high-privilege roles (since PR:H is required, reducing privileged accounts directly shrinks the attack surface) and auditing existing privileged users for compromise; deploying a WordPress-aware WAF (such as Patchstack's own virtual patching) with SQL-injection rule sets in front of the site to filter injection payloads, accepting that WAF rules can occasionally block legitimate form input; and, if the plugin's functionality is non-essential, deactivating and removing persian-gravity-forms entirely, with the trade-off of losing Persian localization of the affected forms.