Home / Vulnerability Intelligence / CVE-2026-32433

CVE-2026-32433 - Vulnerability Analysis

HighCVSS: 8.5

Last Updated: March 13, 2026

codepeople CP Contact Form with Paypal - SQL Injection

Published: March 13, 2026Updated: March 13, 2026Remote Exploitable

Overview

codepeople CP Contact Form with Paypal <= 1.3.61 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

Severity & Score

Severity: High

CVSS Score: 8.5

EPSS Score: 2.1%(Probability of exploitation in next 30 days)

Impact

Attackers can perform blind SQL injection to extract or manipulate database information remotely.

Mitigation

Update to the latest version beyond 1.3.61.

References

https://patchstack.com/database/Wordpress/Plugin/cp-contact-form-with-paypal/vulnerability/wordpress-cp-contact-form-with-paypal-plugin-1-3-61-sql-injection-vulnerability?_s_id=cve

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 13, 2026

🟠 CVE-2026-32433 - High (8.5) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople CP Contact Form with Paypal cp-contact-form-with-paypal allows Blind SQL Injection.This issue affects CP Contact Form with Paypal: fro... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32433/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 13, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-32433
Severity: High
CVSS Score: 8.5
Type: sql_injection
Status: new
EPSS: 2.1%
Social Posts: 2

CWE

CWE-89

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

EPSS Score

2.1%Probability of exploitation in the next 30 days