CVE-2026-14872
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
SQL Injection vulnerability in the WordPress plugin 'Database for Contact Form 7, WPforms, Elementor forms' before version 1.5.5. A parameter is not properly sanitized and escaped before being used in a SQL statement, allowing SQL injection by users with a specific capability (default administrators, but can be delegated).
Risk Assessment
Risk of unauthorized database access, data modification or deletion. Attack can be performed by users with lower privileges if granted.
Recommendation
Update the plugin to version 1.5.5 or later. Limit privilege assignment to minimum and regularly audit user roles.
Other vulnerabilities in Database for Contact Form 7, WPforms, Elementor forms
See all- CVE-2026-14870High
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before version 1.5.3 does not properly sanitize and escape a parameter before reflecting it back in an admin page. This leads to a Reflected Cross-Site Scripting (XSS) that could be used against high-privilege users such as admins.
- CVE-2026-12081Medium
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before version 1.5.2 does not restrict allowed PHP classes when unserializing an attacker-supplied form-field value. This allows unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.
- CVE-2026-9145Medium
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress up to version 1.5.1 contains an arbitrary file copy vulnerability. The create_entry_el() function passes the raw_value from Elementor Pro's Form_Record object directly to PHP's copy() without validation, allowing an attacker to copy any file from the server or from an external URL.
Original NVD description (English source)
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default but can be delegated to lower privileged roles.