CVE-2026-42747: Easy Form Builder WordPress Plugin - Blind SQL Injection (CWE-89)

Overview

CVE-2026-42747 describes a blind SQL injection, classified as CWE-89, in the Easy Form Builder plugin by hassantafreshi. The CNA, Patchstack, published the record. The reference provided points to Patchstack's WordPress plugin vulnerability database entry for this plugin.

Impact

• The CNA assigned a CVSS 3.1 base score of 9.3, with severity rated critical.
• The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L indicates, in our reading, a network-reachable issue with low complexity, no required privileges and no user interaction, with high confidentiality impact and low availability impact.
• The record does not describe the concrete data that could be exposed or altered, so the practical impact on a given site depends on the database access available to the plugin.

Affected products and versions

• The record states that the product is affected from n/a through and including 4.0.6. The lower bound is not specified.
• The structured affected and fixes lists in the record are empty. No fixed version is provided in the sources consulted.
• A missing fixed version does not mean no fix exists. Check the vendor and the Patchstack entry for the current status.

Exploitation status

• The record shows the CVE is not listed in the CISA KEV catalog.
• No confirmed exploitation in the wild appears in the sources consulted.
• The EPSS record gives a probability of 0.004 (about 0.4 percent) with a percentile of 0.32415, dated 2026-10-13. EPSS estimates likelihood of exploitation activity and does not confirm it.

Remediation and mitigation

• Identify whether Easy Form Builder is installed on your WordPress sites, including inactive or forgotten installations.
• Check the Patchstack reference and the vendor for a version newer than 4.0.6 and apply it as soon as it is available and tested.
• If no fixed version is confirmed, consider deactivating or removing the plugin on sites where it is not essential.
• Apply least-privilege principles to the database account used by the web application, and restrict public access to administrative and form-handling endpoints where feasible.
• Consider web application firewall protections as a temporary compensating control, while recognising they are not a substitute for a vendor fix.

Detection guidance

• Review web server and application logs for unusual requests to form-handling endpoints, especially repeated requests with irregular parameter values or noticeably slow responses.
• Monitor database logs for errors or unexpected query behaviour originating from the web application.
• Compare installed plugin versions against the affected range and inventory all WordPress sites where the plugin is present.

Limitations of the available information

• The record does not provide a title, a fixed version, or a lower bound for affected versions.
• The CVSS data comes from the CNA, and no other score is present in the record.
• The source status is Deferred, so the record may be updated.
• The available sources do not describe the vulnerable parameters or the exact data affected, which are not reproduced here for defensive reasons.

Frequently asked questions

What is CVE-2026-42747?

It is a blind SQL injection (CWE-89) in the Easy Form Builder plugin by hassantafreshi, reported by the CNA Patchstack with a CVSS 3.1 score of 9.3.

Which versions are affected?

The record states versions from n/a through and including 4.0.6 are affected. No fixed version is listed in the sources consulted, so check the vendor and Patchstack for updates.

Is this vulnerability known to be exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.