CVE-2026-32433: 
WordPress vulnerability analysis and mitigation

CVE-2026-32433 is a Blind SQL Injection vulnerability in the CP Contact Form with Paypal WordPress plugin developed by CodePeople. It affects all versions from n/a through 1.3.61 (inclusive) and stems from improper neutralization of special elements used in SQL commands (CWE-89). The vulnerability was published on March 13, 2026, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 8.5 (High) (Feedly, Patchstack).

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and enables Blind SQL Injection attacks. An authenticated attacker with low privileges can send crafted network requests to the plugin's endpoints, injecting malicious SQL syntax that is passed unsanitized to the underlying database. Because the injection is "blind," the attacker infers database contents through boolean-based or time-based response differences rather than direct output. The changed scope (S:C) in the CVSS vector indicates that the impact extends beyond the plugin itself to the broader WordPress database (Feedly, Patchstack).

Successful exploitation allows an authenticated attacker to extract sensitive data from the WordPress database, including user credentials, personal information, payment-related records, and site configuration data (High confidentiality impact). Availability is also marginally affected (Low), potentially through resource exhaustion caused by heavy SQL queries. Integrity is not directly impacted by this vulnerability, but stolen credentials could enable further account takeover and lateral movement within the WordPress environment (Feedly).

The vulnerability requires low-privilege authentication (e.g., a subscriber-level WordPress account) and no user interaction, making it relatively accessible to attackers. The EPSS score is approximately 0.021% (0.000210), indicating a currently low probability of active exploitation in the wild. No public proof-of-concept exploit code, exploit kit integration, threat actor attribution, or CISA KEV catalog listing has been identified at this time (Feedly).

1. Reconnaissance: Identify WordPress sites running the CP Contact Form with Paypal plugin version ≤ 1.3.61 using tools like WPScan (wpscan --url <target> --enumerate p) or by checking the plugin's readme.txt file at /wp-content/plugins/cp-contact-form-with-paypal/readme.txt.
2. Obtain low-privilege credentials: Register or obtain a low-privilege WordPress account (e.g., subscriber role) on the target site, as the vulnerability requires authenticated access.
3. Identify the vulnerable parameter: Interact with the plugin's form or admin-facing endpoints to locate the input parameter(s) that are passed unsanitized to SQL queries.
4. Craft a Blind SQL Injection payload: Use boolean-based or time-based blind injection techniques. For example, append a time-delay payload such as ' AND SLEEP(5)-- - to the vulnerable parameter to confirm exploitability.
5. Extract data: Use an automated tool such as sqlmap (sqlmap -u "<target_url>" --data="<post_params>" --level=3 --risk=2 --dbms=mysql --dump) to systematically extract database contents, including WordPress user table credentials (wp_users).
6. Leverage extracted data: Use harvested credentials (e.g., admin password hashes) to escalate privileges, crack hashes offline, or perform further attacks on the WordPress installation (Feedly, Patchstack).

• Network: Unusual or repeated HTTP POST/GET requests to CP Contact Form with Paypal plugin endpoints containing SQL metacharacters (e.g., single quotes ', --, SLEEP, BENCHMARK, AND 1=1, OR 1=1) in parameter values.
• Logs: WordPress or web server access logs showing high volumes of requests to plugin-specific URLs with anomalous query strings; time-delayed responses (e.g., 5-second gaps) indicative of time-based blind SQL injection probing.
• Database: Unexpected or unauthorized database queries logged in MySQL slow query logs involving SLEEP(), BENCHMARK(), or complex nested SELECT statements originating from the WordPress application user.
• Process: Unusual database load spikes or long-running queries associated with the WordPress database user during off-hours.

Users should update the CP Contact Form with Paypal plugin to a version beyond 1.3.61 that includes a patch for this vulnerability — check the WordPress plugin repository for the latest release. If an immediate update is not possible, consider deactivating the plugin until a patched version is available. Additionally, implementing a Web Application Firewall (WAF) with SQL injection rules (e.g., Wordfence, Cloudflare WAF) can help block exploitation attempts in the interim. Restrict plugin access to trusted roles only and audit WordPress user accounts for unnecessary low-privilege accounts (Patchstack).

The vulnerability received brief coverage from security news aggregators and social media shortly after its March 13, 2026 publication. The Hacker Wire published a dedicated article on the blind SQL injection issue, and the CVE was noted on Mastodon and Bluesky by automated CVE tracking accounts. No significant vendor statements or notable researcher commentary beyond the Patchstack advisory have been identified (The Hacker Wire).