CVE-2026-42747
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
CVE-2026-42747 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in Easy Form Builder. This issue affects versions from n/a through 4.0.6.
Risk Assessment
An attacker could exploit this vulnerability to perform SQL Injection attacks, potentially leading to unauthorized access to database information. This poses a serious threat to the integrity and confidentiality of the organization's data.
Recommendation
It is recommended to update Easy Form Builder to the latest version to mitigate this vulnerability. Additionally, conducting a security audit of the application is advisable to identify other potential weaknesses.
Other vulnerabilities in Easy Form Builder
See all- CVE-2026-59517High
The Easy Form Builder plugin version 4.0.12 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
- CVE-2025-67577Medium
The Easy Form Builder plugin (by hassantafreshi) contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Easy Form Builder from n/a through <= 3.8.20.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Blind SQL Injection.This issue affects Easy Form Builder: from n/a through <= 4.0.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS