CVE-2025-46252
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kofi Mokome Message Filter for Contact Form 7 allows SQL Injection. This issue affects Message Filter for Contact Form 7: from n/a through 1.6.3.2.
Risk Assessment
Risk of data theft, database modification, or admin account takeover.
Recommendation
Update the Message Filter for Contact Form 7 plugin to a version newer than 1.6.3.2 that includes the fix.
Other vulnerabilities in Message Filter for Contact Form 7
See all- CVE-2026-65438High
XSS vulnerability in Message Filter for Contact Form 7 up to version 1.6.3.9. An unauthenticated attacker can inject malicious JavaScript.
- CVE-2026-57423High
The Message Filter for Contact Form 7 WordPress plugin is vulnerable to Reflected Cross-site Scripting (XSS) in versions up to and including 1.6.3.8. An attacker can inject malicious scripts due to improper input neutralization during page generation.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kofi Mokome Message Filter for Contact Form 7 allows SQL Injection. This issue affects Message Filter for Contact Form 7: from n/a through 1.6.3.2.