Improper neutralization of special elements in SQL commands allows a blind SQL injection in the Contact Form 7 HubSpot integration plugin. An attacker can execute arbitrary SQL queries against the database, potentially reading or altering sensitive data. The flaw is a classic input validation problem listed as CWE‑89.

The vulnerability affects the CRM Perks Integration for Contact Form 7 HubSpot plugin with versions up through 1.4.2. All releases from the initial version up to and including 1.4.2 are impacted, as the plugin does not sanitize parameters used in database queries.

The CVSS score of 7.6 signifies high severity, but the EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not present in the CISA KEV catalog, indicating no known active exploitation yet. Based on the description, the likely attack vector is remote, through normal form submissions or API requests that the plugin handles, allowing an attacker to craft malicious input that the plugin forwards to the database.