CVE-2026-61955

WordPress گرویتی فرم فارسی plugin <= 3.0.2 - SQL Injection vulnerability

Published Jul 13, 2026 CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویتی فرم فارسی persian-gravity-forms allows Blind SQL Injection.This issue affects گرویتی فرم فارسی: from n/a through <= 3.0.2.

Analysis

Technical impact

Improper neutralization of special elements in an SQL command allows an attacker to perform blind SQL injection against the Persian Gravity Forms plugin. This flaw can enable the extraction of sensitive data, credential theft, or manipulation of database contents without authentication. The vulnerability arises from unsanitized input handling that is directly used in SQL queries.

Affected Systems

The issue affects the Persian Gravity Forms plugin (Hannan:گرویتی فرم فارسی) for WordPress, specifically all releases up to and including version 3.0.2. No other product variants or versions are listed as vulnerable.

Risk and Exploitability

The component carries a CVSS score of 7.6, indicating high severity, while its EPSS score is below 1%, indicating a low current likelihood of exploitation. The vulnerability is not present in the CISA KEV catalog. Based on the description, the attack vector is inferred to be a web‑based input submitted to the plugin, likely by an unauthenticated user. Successful exploitation would provide an attacker with read access to the underlying database, potentially exposing confidential data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Hannan

گرویتی فرم فارسی

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.0.2

No data.

Vendor Product Versions

Hannan

گرویتی فرم فارسی

Version	Status	Scheme	Platform
`[0,3.0.2]`	affected	generic	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Persian Gravity Forms to a version newer than 3.0.2 to remove the vulnerable code.
Deploy a web application firewall and configure it to block or filter typical SQL injection payloads targeting the plugin’s input points.
Ensure that all user‑supplied data handled by the plugin is properly escaped or parameterized in accordance with CWE‑89 best practices, and review database permissions to enforce least privilege for application accounts.

Generated by OpenCVE AI on August 1, 2026 at 10:15 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.383% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/persian-gravity-forms/vulnerability/wordpress-ro-t-frm-f-rs-plugin-3-0-2-sql-injection-vulnerability?_s_id=cve

History

Jul 13, 2026 3:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Hannan Hannan گرویتی فرم فارسی Wordpress Wordpress wordpress
Vendors & Products		Hannan Hannan گرویتی فرم فارسی Wordpress Wordpress wordpress

Jul 13, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 13, 2026 10:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویتی فرم فارسی persian-gravity-forms allows Blind SQL Injection.This issue affects گرویتی فرم فارسی: from n/a through <= 3.0.2.
Title		WordPress گرویتی فرم فارسی plugin <= 3.0.2 - SQL Injection vulnerability
Weaknesses		CWE-89
References		https://patchstack.com/database/Wordpress/Plugin/persian-gravity-forms/vulnerability/wordpress-ro-t-frm-f-rs-plugin-3-0-2-sql-injection-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L'}`