Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows …

A SQL injection vulnerability (CVE-2026-42747) has been identified in the Easy Form Builder WordPress plugin by hassantafreshi. The vulnerability allows for blind SQL injection attacks due to improper neutralization of special elements used in SQL commands. The issue affects Easy Form Builder versions up to and including 4.0.6. This vulnerability could allow attackers to extract sensitive database information through blind SQL injection techniques. The vulnerability has been assigned a high criticality rating.