CVE-2024-1776 is a high severity (CVSS 7.2) SQL injection in the Admin side data storage for Contact Form 7 WordPress plugin, in all versions up to and including 1.1.1. It needs an administrator account. Update to a release newer than 1.1.1 once you confirm one exists in the plugin changelog.
What's affected
Admin side data storage for Contact Form 7, by Zestard, all versions up to and including 1.1.1. The description pins the issue on the form-id parameter, which is not escaped properly, and says the existing SQL query is not prepared.
The weakness is CWE-89, SQL injection. The description states that authenticated attackers with administrator level access or above can append extra SQL to an existing query and use it to extract sensitive information from the database.
The NVD record does not list a fixed version. The only references are a file in the plugin repository and a Wordfence entry, and I could not retrieve the Wordfence page. Check the plugin changelog on WordPress.org to see which release addresses the issue.
How to check if you're exposed
List the plugin and its version with WP-CLI:
wp plugin list --name=admin-side-data-storage-for-contact-form-7 --fields=name,status,version,update
Or check the Plugins screen in the dashboard. Version 1.1.1 or lower is affected.
The high privilege requirement matters here. The attacker already has an administrator login, or has taken one over. So also review your administrator list:
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
Any account you do not recognise deserves attention before you worry about this plugin.
What to do now
- Check the installed version with the command above.
- Update the plugin as soon as a release newer than 1.1.1 is offered, and confirm the changelog mentions the fix.
- If no fixed release exists, deactivate the plugin and export stored form data first if you still need it.
- Audit administrator accounts, remove unused ones, and turn on two factor sign in for the rest.
- Make sure the database user WordPress connects with has only the rights it needs.
Why it matters
SQL injection happens when input becomes part of a query string instead of being passed as data. The standard fix is a prepared statement, where the query text and the values travel separately. The description says that is exactly what is missing here.
The score is high rather than critical because the attacker must already be an administrator. On many sites an administrator can already read plenty of data, so the extra reach is the database itself, including tables other plugins use and data the admin screens do not show. That makes the bug most relevant on multi author sites and agencies where several people hold admin accounts, and after any account takeover.
Nothing retrieved says this CVE is exploited, and the Known Exploited Vulnerabilities flag in the record is false.
Quick check
Can an anonymous visitor exploit this?
Not according to the description. It says administrator level access or above is required.
Why patch if attackers need admin access?
Admin credentials get phished and reused. A flaw like this widens what a stolen admin login can read, so it is worth closing.
Sources
- NVD record for CVE-2024-1776
- Plugin source reference listed in the record
- Wordfence entry listed in the record (not retrievable when reviewed)
Last reviewed: 19 October 2026.
