Database for Contact Form 7, WPforms, Elementor forms, CVE-2026-14872

CVE, Research URL: CVE-2026-14872
Home page URL: Security reports for Database for Contact Form 7, WPforms, Elementor forms
Application: Database for Contact Form 7, WPforms, Elementor forms
Published on: Aug 04, 2026
Research Description: The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default but can be delegated to lower privileged roles.
Affected versions: max 1.5.5.
Status: vulnerable