Improper handling of user supplied data in the Contact Form 7 Round Robin Lead Distribution plugin creates an SQL injection flaw. An attacker can inject arbitrary SQL code and potentially read, modify or delete database contents. The vulnerability directly exposes the database to tampering and data leakage, threatening the confidentiality, integrity, and availability of the site’s data.

The flaw exists in the David Jeffrey Contact Form 7 Round Robin Lead Distribution plugin for WordPress, affecting all versions up to and including 1.2.1.

The CVSS score of 7.6 indicates a high severity. The EPSS score of less than 1% suggests that exploitation is not common yet, but the vulnerability is not yet listed in the CISA KEV catalog. Attackers would likely exploit the vulnerability by submitting malicious input through the plugin’s contact form interface, which is reachable via the web front‑end.