CVE-2026-14872: Unknown Database For Contact Form 7, Wpforms, Elementor Forms

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default but can be delegated to lower privileged roles.

Affected products

• Unknown Database For Contact Form 7, Wpforms, Elementor Forms: before 1.5.5 (fixed in 1.5.5)

Published 2026-08-04. Last modified 2026-08-26.