CVE-2026-16614

Name of the Vulnerable Software and Affected Versions GSheetConnector versions prior to 5.2.2

Description The GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress contains a SQL Injection flaw. Authenticated attackers with administrator-level access or higher can append malicious SQL queries to existing ones to extract sensitive database information. This occurs because the s parameter is not properly escaped and the SQL query is not sufficiently prepared. Specifically, the use of wp unslash() removes magic-quote protection and sanitize text field() fails to escape SQL metacharacters, allowing single quotes to remain intact before interpolation into the query.

Recommendations Update to a version newer than 5.2.1. As a temporary mitigation, restrict access to the administrative functions that utilize the s parameter.