Executive brief
A WordPress plugin used to manage contact form entries for multiple form builders fails to securely validate user input before executing database queries. An authenticated attacker with entry-read permissions (typically administrators) can inject malicious SQL commands to read or modify database contents, including sensitive data like user credentials.
Technical details
The plugin contains an authenticated SQL injection vulnerability in the entry management functionality via the `id` parameter. The vulnerable code constructs a database UPDATE statement by directly concatenating the user-supplied `id` parameter without using prepared statements or type casting. While an existence check uses a parameterized placeholder (%d), this validation is bypassed because the unsanitized value is later used raw in the UPDATE query. An attacker with the plugin's entry-read capability (granted to administrators by default, but can be delegated to lower-privileged roles) can exploit this by injecting SQL payloads when marking entries as read. Time-based blind SQL injection is possible, allowing attackers to extract arbitrary data from the database.
Affected products
- Contact Form 7 Database for Contact Form 7, WPforms, Elementor forms before 1.5.5
Timeline
- 2026-07-27: disclosed
- 2026: patched: Fixed in version 1.5.5
- 2026-08-04: advisory