CVE-2026-14872
Received Received - Intake

SQL Injection in Contact Form 7 Database WordPress Plugin

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: WPScan

Description
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default but can be delegated to lower privileged roles.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-14872
EUVD
EUVD-2026-52587

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
wpforms wpforms to 1.5.5 (exc)
elementor elementor_forms to 1.5.5 (exc)
contact_form_7 contact_form_7 to 1.5.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in WordPress plugins for contact forms (Contact Form 7, WPforms, Elementor forms). The flaw exists because user input is not properly sanitized before being used in SQL queries. Attackers with specific capabilities (default restricted to administrators but potentially delegated) could exploit this to manipulate database queries.

Detection Guidance

To detect this vulnerability, check the installed version of the Database for Contact Form 7, WPforms, or Elementor forms WordPress plugin. If the version is below 1.5.5, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to your WordPress database, potentially exposing sensitive data like form submissions, user information, or other stored content. Attackers might also modify or delete database entries.

Compliance Impact

This vulnerability could lead to data breaches, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations may face legal penalties, fines, or reputational damage if exploited due to unauthorized data exposure.

Mitigation Strategies

Immediately update the affected plugin to version 1.5.5 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review user roles to ensure only trusted administrators have elevated capabilities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14872. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart