PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-61955 Hannan CVE debrief

A SQL injection vulnerability was discovered in the Persian Gravity Forms plugin. This issue allows for Blind SQL Injection and affects versions up to and including 3.0.2. The vulnerability has a CVSS score of 7.6 and is considered HIGH severity. Users of the plugin should be aware of this vulnerability and take steps to mitigate it. The CVE record was published on 2026-07-13T10:16:46.450Z and has not been modified since then.

Vendor
Hannan
Product
گرویتی فرم فارسی
CVSS
HIGH 7.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-13
Original CVE updated
2026-07-13
Advisory published
2026-07-13
Advisory updated
2026-07-13

Who should care

Users of the Persian Gravity Forms plugin, particularly those using version 3.0.2 or earlier, should be aware of this vulnerability and take steps to mitigate it. This includes updating the plugin to a version that addresses this SQL injection vulnerability and implementing additional security measures.

Technical summary

The CVE-2026-61955 vulnerability is classified as Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It has a CVSS score of 7.6 and is considered HIGH severity. The vulnerability affects the Persian Gravity Forms plugin, specifically versions up to and including 3.0.2.

Defensive priority

High priority should be given to updating the Persian Gravity Forms plugin to a version that addresses this SQL injection vulnerability.

Recommended defensive actions

  • Update the Persian Gravity Forms plugin to the latest version available.
  • Review and monitor database activity for suspicious SQL queries.
  • Implement additional security measures such as web application firewalls (WAFs) to detect and prevent SQL injection attacks.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-07-13T10:16:46.450Z and has not been modified since then. The NVD entry is currently in the 'Received' status. Limited information is available about the specific details of the vulnerability and its impact. The vulnerability affects the Persian Gravity Forms plugin, specifically versions up to and including 3.0.2.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-13T10:16:46.450Z and has not been modified since then. The NVD entry is currently in the 'Received' status.