CVE-2025-23784: Contact Form 7 Round Robin SQLi Flaw

CVE-2025-23784 Overview

CVE-2025-23784 is a SQL Injection vulnerability in the David Jeffrey Contact Form 7 Round Robin Lead Distribution WordPress plugin. The flaw affects all plugin versions up to and including 1.2.1. Attackers with high-privilege access can inject crafted SQL statements through improperly neutralized input, manipulating backend database queries. The issue is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vulnerability carries a network attack vector with scope change, meaning successful exploitation can impact resources beyond the vulnerable component.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, leading to confidential data disclosure and limited availability impact across the affected site.

Affected Products

David Jeffrey Contact Form 7 Round Robin Lead Distribution plugin for WordPress
Plugin slug: contact-form-7-round-robin-lead-distribution
All versions from n/a through 1.2.1

Discovery Timeline

2025-01-22 - CVE-2025-23784 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23784

Vulnerability Analysis

The Contact Form 7 Round Robin Lead Distribution plugin fails to properly sanitize user-supplied input before incorporating it into SQL statements. This deficiency lets attackers append or alter SQL syntax processed by the WordPress database backend. The vulnerability requires authenticated access with elevated privileges, narrowing the attacker pool to users already trusted within the WordPress instance. However, the scope is marked as changed, indicating exploitation can influence components beyond the plugin itself. Confidentiality impact is high, while integrity remains unaffected and availability impact is low. The EPSS probability for exploitation is 0.437%.

Root Cause

The root cause is improper neutralization of special characters in SQL commands [CWE-89]. The plugin concatenates untrusted input directly into SQL queries rather than using parameterized statements or the WordPress $wpdb->prepare() API. This pattern allows SQL metacharacters such as single quotes, semicolons, and comment sequences to break query structure.

Attack Vector

An authenticated attacker with high privileges sends a crafted HTTP request containing malicious SQL fragments to a vulnerable plugin endpoint. The plugin embeds the input into a database query without sanitization. The injected payload executes within the WordPress database context, enabling extraction of sensitive records such as user credentials, session tokens, or lead data managed by the plugin. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-23784

Indicators of Compromise

Unexpected SQL syntax such as UNION SELECT, SLEEP(, or -- in HTTP request parameters targeting /wp-admin/ endpoints associated with the plugin.
Database error messages or unusually slow responses from pages handled by contact-form-7-round-robin-lead-distribution.
Authenticated administrative sessions issuing atypical query patterns against wp_users, wp_usermeta, or plugin-specific tables.

Detection Strategies

Inspect web server access logs for requests to plugin endpoints containing encoded SQL metacharacters (%27, %22, %3B).
Enable WordPress database query logging and alert on queries originating from plugin code that include user-controlled string concatenation.
Deploy a web application firewall ruleset that flags SQL injection signatures targeting WordPress plugin parameters.

Monitoring Recommendations

Audit privileged WordPress accounts and review their activity for unauthorized query patterns or data exports.
Monitor outbound database connections and response sizes for anomalies indicating bulk data exfiltration.
Track plugin version inventory across WordPress deployments to identify hosts still running version 1.2.1 or earlier.

How to Mitigate CVE-2025-23784

Immediate Actions Required

Identify all WordPress installations running the Contact Form 7 Round Robin Lead Distribution plugin at version 1.2.1 or earlier.
Restrict administrative access to the WordPress backend and rotate credentials for high-privilege users.
Apply a web application firewall rule blocking SQL injection payloads against plugin endpoints until a patched version is available.

Patch Information

No fixed version has been published in the referenced advisory at the time of NVD publication. Consult the Patchstack Vulnerability Report for the latest remediation status and apply vendor updates as soon as they are released.

Workarounds

Deactivate and remove the plugin until a patched release is available.
Replace the plugin with an alternative lead distribution solution that uses parameterized database queries.
Limit administrative WordPress accounts and enforce multi-factor authentication to reduce the likelihood of privileged abuse.

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate contact-form-7-round-robin-lead-distribution
wp plugin delete contact-form-7-round-robin-lead-distribution