Skip to content
Sign in
6.8 Medium

CVE-2026-14872 The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and…

Description

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default but can be delegated to lower privileged roles.

Affected products and versions

Product Affected versions Fixed in
Database for Contact Form 7, WPforms, Elementor forms 1.5 earliest → < 1.5.5 1.5.5

Other CVEs of Database for Contact Form 7, WPforms, Elementor forms

The 3 CVEs of Database for Contact Form 7, WPforms, Elementor forms →
CVE-2026-14870 The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and… 7.1 High CVE-2026-12081 The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP… 5.0 Medium
Track this CVE