CVE-2026-16614 describes an SQL Injection vulnerability in the GSheetConnector – CF7 Google Sheets Connector WordPress plugin versions up to and including 5.2.1. The flaw is due to insufficient sanitization and escaping of the 's' parameter, which is used in SQL queries without proper preparation. Authenticated attackers with administrator privileges can exploit this to append arbitrary SQL commands, potentially extracting sensitive database information. The vulnerability stems from the use of wp_unslash() which strips magic-quote protections and sanitize_text_field() which does not escape SQL metacharacters, leaving the input vulnerable when interpolated into SQL statements.

An attacker with administrator-level access can exploit this vulnerability to perform SQL Injection attacks, allowing them to extract sensitive information from the database. The vulnerability does not impact confidentiality beyond data extraction, nor does it affect integrity or availability directly. The CVSS score of 4.9 (medium) reflects the requirement for high privileges and the absence of impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to SQL query manipulation. Avoid using affected versions (<=5.2.1) in production environments if possible.