The vulnerability arises from improper neutralization of specialized elements in SQL commands, allowing an attacker to inject arbitrary SQL statements via the contact form. The flaw is rooted in the Kofi Mokome Message Filter for Contact Form 7 plugin and is classified as CWE‑89. If exploited, an attacker could read, modify, or delete data stored in the WordPress database, potentially leaking sensitive information or corrupting the site’s content.

The issue affects all versions of the Kofi Mokome Message Filter for Contact Form 7 plugin up to and including 1.6.3.2. Systems running WordPress installations that have this plugin installed are vulnerable; no specific WordPress core version is listed as a limitation.

The vulnerability carries a CVSS score of 7.6, indicating a high risk to confidentiality and integrity, but its EPSS score is below 1 %, suggesting a low likelihood of exploitation in the wild. The vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog, further indicating limited current exploitation evidence. The likely attack vector is the submission of crafted input through the contact form, which is inferred from the description and would be an unauthenticated remote attack over HTTP/HTTPS. While no active exploits have been reported, the high severity warrants action.