What is the CVSS score of EUVD-2026-51753?

EUVD-2026-51753 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

CF7 Google Sheets Connector EUVD-2026-51753

| CVE-2026-16614 MEDIUM

SQL Injection (CWE-89)

2026-08-01 Wordfence

GHSA-987r-2928-h3pg

WordPress SQLi Google Wordpress Plugin Gsheetconnector Cf7 Google Sheets Connector Westerndeal

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Network-accessible admin panel (AV:N), low complexity post-auth (AC:L), administrator credentials required (PR:H), read-only database exfiltration with no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 01, 2026 - 08:55 vuln.today

CVE Published

Aug 01, 2026 - 07:49 cve.org

MEDIUM 4.9

DescriptionCVE.org

The GSheetConnector - CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 5.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. wp_unslash() strips magic-quote protection and sanitize_text_field() does not escape SQL metacharacters, leaving single quotes and other SQL metacharacters intact before the value is interpolated into the query.

AnalysisAI

SQL injection in the GSheetConnector CF7 Google Sheets Connector WordPress plugin (all versions through 5.2.1) enables authenticated administrators to exfiltrate arbitrary database contents via the unsanitized 's' search parameter. The root cause is a flawed sanitization chain: wp_unslash() removes magic-quote escaping while sanitize_text_field() fails to neutralize SQL metacharacters, leaving single quotes intact before direct query interpolation. No public exploit or CISA KEV listing has been identified at time of analysis, but the Wordfence disclosure includes direct source-code references confirming the vulnerable code paths in class-gs-cf7db-formEntryList.php and gs-cf7db.php.

Technical ContextAI

The vulnerable plugin (CPE: cpe:2.3:a:westerndeal:gsheetconnector_-_cf7_google_sheets_connector:*:*:*:*:*:*:*:*) is a WordPress add-on that bridges Contact Form 7 form submissions with Google Sheets. The vulnerability is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The flaw resides in the admin-facing form entry list view: the 's' parameter - used for searching form submissions - passes through wp_unslash() (which strips PHP magic-quote backslash escaping) and then sanitize_text_field() (which performs HTML/whitespace cleaning but explicitly does not escape SQL metacharacters). The resulting string is then interpolated directly into a SQL query without use of WordPress's $wpdb->prepare() or parameterized queries, violating WordPress coding standards. Affected code paths are confirmed at class-gs-cf7db-formEntryList.php lines 34 and 64, and gs-cf7db.php line 340 in the 5.1.7 tag, indicating the issue predates and persists through 5.2.1.

RemediationAI

Update to the patched version of GSheetConnector CF7 Google Sheets Connector immediately via the WordPress plugin dashboard; the fix corresponds to repository changeset 3628480 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3628480%40cf7-google-sheets-connector&new=3628480%40cf7-google-sheets-connector - verify the installed version exceeds 5.2.1 once an updated release is tagged. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/83455de5-4fb2-4782-8063-646d3daf29e5 should be monitored for the confirmed patched version number. If immediate upgrade is not possible, restrict the WordPress admin panel to known IP ranges using server-level access controls (e.g., nginx allow/deny directives or .htaccess restrictions on wp-admin) to reduce the exposure surface - note this does not eliminate the flaw but raises the bar for remote exploitation. Audit administrator-level accounts on the affected WordPress installation and remove any unnecessary admin accounts to minimize the pool of potential exploiters. A Web Application Firewall rule blocking SQL metacharacters in the 's' parameter on the affected admin page can serve as a compensating control, though WAF bypass is possible and should not substitute for patching.