The GSheetConnector – CF7 Google Sheets Connector plugin for WordPress contains a generic SQL Injection flaw in the 's' parameter. The input is not properly escaped before being interpolated into a SQL statement, allowing an attacker who is authenticated with administrator-level or higher privileges to append arbitrary SQL queries. This can lead to reading or extracting sensitive information from the database, constituting a data theft vulnerability.

The vulnerability affects the WestEndDeal GSheetConnector – CF7 Google Sheets Connector WordPress plugin. All plugin releases from the earliest version up to and including 5.2.1 are impacted. Administrators or any user with elevated privileges who can access the plugin’s configuration interface are at risk. No newer releases have been documented as vulnerable.

The CVSS score of 4.9 indicates a medium severity, while the EPSS score of less than 1% reflects a very low probability of real-world exploitation. The vulnerability is not listed in the CISA KEV catalog. Because exploitation requires administrative access, the likelihood of an attack depends on the organization’s privileged account management. In tightly controlled environments the risk may be acceptable, but the potential for credential compromise or insider threat remains.