The Sanjeev SW Contact Form plugin (version 1.0 and earlier) contains an improper neutralization of special elements in SQL commands, resulting in a blind SQL Injection vulnerability. This flaw enables an attacker with network access and low privileges to inject SQL commands without user interaction, potentially compromising the confidentiality of the backend database. The CVSS score is 8.5, reflecting high impact on confidentiality and low impact on availability, with no integrity impact. No patch or vendor advisory has been provided to date.

Successful exploitation of this vulnerability could allow an attacker to extract sensitive information from the database (high confidentiality impact) without affecting data integrity, but with some limited impact on availability. The attack requires network access and low privileges but no user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable plugin and monitor for updates from the vendor. Avoid exposing the contact form to untrusted networks if possible.