Database for Contact Form 7, WPforms, Elementor Forms Unauthenticated PHP Object Injection Vulnerability

A vulnerability exists in the Database for Contact Form 7, WPforms, and Elementor Forms WordPress plugin versions prior to 1.5.2. The issue arises because the plugin does not properly restrict PHP classes during the unserialization of user-supplied form-field values. This flaw allows unauthenticated users to inject arbitrary PHP objects, which are then instantiated when an administrator views the corresponding entry. This vulnerability represents an incomplete fix for CVE-2025-7384 and CVE-2026-2599, as the entry-editor file-field path was overlooked.

Impact

Exploitation of this vulnerability allows for unauthenticated PHP object injection, which can lead to arbitrary code execution on behalf of an administrator.

Reproduction

To reproduce this vulnerability, an unauthenticated user must submit a contact form that includes a file-upload field, such as one created with Contact Form 7. The attacker can send a serialized PHP object as a normal text parameter in the file field, without attaching an actual file. Once the form is submitted, the injected object is stored by the plugin. When an administrator later opens the entry and saves it, the injected object is unserialized and instantiated, executing any embedded payloads.

Remediation

Users are advised to update the Database for Contact Form 7, WPforms, Elementor Forms WordPress plugin to version 1.5.2 or later.