CWE‑89 (Improper Neutralization of Special Elements used in an SQL Command) underlies a blind SQL injection flaw in the Codepeople CP Contact Form with PayPal plugin. Key detail from CVE description: the vulnerability permits attackers to inject malicious SQL through the contact form, potentially allowing them to read or modify underlying database records. The impact is a data breach that could expose sensitive user data or compromise site functionality.

Systems using the WordPress plugin Codepeople CP Contact Form with PayPal version 1.3.61 or earlier are affected. This includes any WordPress site that has installed the plugin without upgrading past the vulnerable version.

The CVSS score of 8.5 classifies this issue as High severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to submit a crafted payload via the plugin’s contact form; the lack of error messages means the attack is blind, but timing or other side channels can still reveal database structure or data.