CVE-2026-16614 describes an SQL Injection vulnerability in the GSheetConnector – CF7 Google Sheets Connector WordPress plugin. The vulnerability affects all versions up to and including 5.2.1 and is due to improper neutralization of special SQL elements in the 's' parameter. The plugin uses wp_unslash() to strip magic quotes and sanitize_text_field() for sanitization, but these functions do not escape SQL metacharacters such as single quotes. Consequently, authenticated users with administrator privileges can inject additional SQL queries into existing database queries, potentially extracting sensitive information. The CVSS 3.1 base score is 4.9 (medium severity), with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

An authenticated attacker with administrator-level access can exploit this vulnerability to perform SQL Injection attacks, allowing them to extract sensitive information from the database. The vulnerability does not affect integrity or availability but has a high impact on confidentiality. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity. Avoid using the vulnerable plugin versions and consider disabling or removing the plugin if possible.