CVE-2026-14872

Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default but can be delegated to lower privileged roles.

Affected

Database for Contact Form 7, WPforms, Elementor forms

CVSS v3.1 CNA

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

EPSS

0.39% chance of exploitation in the next 30 days, 32nd percentile

Published

2026-08-04

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/557414c2-70b9-4466-8727-d8a2c9a8a502/

References

• CVE Record
• NVD entry