Contact Form 7 DB EUVD-2026-52587

Exploitation requires authenticated access to the WordPress installation with the specific capability used by the plugin's database management functionality. By default, this capability is restricted to users in the Administrator role. However, exploitation is possible at lower privilege levels if a site administrator has explicitly delegated this capability to Editor, Author, Contributor, or a custom role - a configuration choice that is non-default but not uncommon in multi-author or agency-managed WordPress sites. Limiting factors include: the attacker must be an authenticated WordPress user (PR:H by default), the target site must have the plugin installed and active, and exploitation only achieves database reads (C:H) with no write or denial-of-service capability (I:N/A:N). No special network positioning or pre-existing code execution is required beyond valid credentials and plugin access.

Real-world risk is moderate despite a 6.8 CVSS score. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N correctly identifies the network-accessible attack surface (WordPress admin panel) but the PR:H requirement anchors realistic exploitation to actors who already hold administrator-level access or have been explicitly granted the delegated capability - meaningfully limiting the attacker pool. The scope change (S:C) and high confidentiality impact (C:H) are the most significant signals: a successful injection can read the entire database, not just plugin-specific tables. EPSS at 0.16% (5th percentile) is very low, suggesting the security community does not anticipate broad opportunistic exploitation, likely due to the authentication barrier. No CISA KEV listing corroborates this low exploitation rate. Counterbalancing this, publicly available exploit code from WPScan lowers the technical bar for any attacker who already has the required capability. The delegation aspect is a notable risk amplifier: WordPress administrators can grant this capability to editors, contributors, or custom roles, inadvertently expanding the attacker surface beyond true site admins. The impact is read-only (I:N/A:N), so confidentiality breach - not system compromise or service disruption - is the primary concern.

An attacker who holds WordPress administrator credentials (or any lower-privileged role that an administrator has explicitly granted the plugin's management capability to) navigates to the plugin's database management interface and submits a crafted SQL injection payload via the unsanitized parameter. The malicious query executes against the WordPress MySQL database, returning sensitive data such as form submission contents, user credentials from wp_users, or configuration data from wp_options. A publicly available proof-of-concept from WPScan documents the technique, reducing the required skill level for any authenticated attacker.