Junglewise Threat Intelligence

CVE-2026-16614: westerndeal GSheetConnector SQL Injection via s parameter

CVE-2026-16614 · Severity: medium · CVSS 4.9 · Published 2026-08-01

Executive brief

The GSheetConnector plugin for WordPress, which synchronizes Contact Form 7 data with Google Sheets, contains a security flaw that allows administrators to run unauthorized database commands. By exploiting this vulnerability, a high-privileged user could extract sensitive information from the website's database. While this requires administrative access, it could be used by a malicious insider or an attacker who has already compromised an admin account to deepen their access.

Technical details

A SQL injection vulnerability exists in the GSheetConnector plugin for WordPress due to improper handling of the 's' parameter. The root cause is the use of wp_unslash(), which removes magic-quote protection, combined with sanitize_text_field(), which fails to escape SQL metacharacters like single quotes. Because the resulting value is interpolated directly into a SQL query without sufficient preparation or escaping, authenticated attackers with administrator-level privileges can append malicious SQL queries. This can be leveraged to extract sensitive information from the WordPress database. The vulnerability is present in all versions up to and including 5.2.1.

Affected products

  • westerndeal GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync <= 5.2.1

Timeline

  • 2026-08-01: disclosed
  • 2026-08-01: advisory

References