The vulnerability CVE-2026-32433 in codepeople CP Contact Form with Paypal (up to version 1.3.61) is an improper neutralization of special elements in SQL commands, resulting in a blind SQL injection flaw. This allows an attacker with network access and low privileges to execute crafted SQL queries that can disclose confidential information without affecting data integrity or causing significant denial of service. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, no user interaction, and partial impact on confidentiality and availability.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the backend database (confidentiality impact is high). Integrity is not impacted, and availability impact is low. The vulnerability requires low privileges and no user interaction, increasing the risk of exploitation. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, users should consider restricting access to the vulnerable component and monitor for unusual database queries. Apply vendor patches promptly once available.