This vulnerability in the CRM Perks Integration for Contact Form 7 HubSpot plugin (<= 1.4.2) involves improper neutralization of special elements in SQL commands, enabling Blind SQL Injection attacks. An attacker with high privileges can exploit this to extract sensitive information from the backend database without user interaction. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability is published and reserved as of December 2025, but no patch or remediation details are currently available.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database due to Blind SQL Injection. The confidentiality impact is high, but integrity is not affected, and availability impact is low. The attacker must have high privileges to exploit this vulnerability, limiting the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor for vendor updates and avoid granting unnecessary high privileges to users of the affected plugin. Applying principle of least privilege may reduce risk until a fix is available.