What is the CVSS score of CVE-2025-4665?

CVE-2025-4665 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Contact Form CFDB7 are affected by CVE-2025-4665?

Contact Form CFDB7, a WordPress plugin, contains a critical unauthenticated SQL injection that can cascade into PHP object injection and allow remote attackers to fully compromise affected WordPress…

How to fix or mitigate CVE-2025-4665?

Within 24 hours, inventory all WordPress sites for Contact Form CFDB7 versions up to and including 1.3.2, deactivate and remove the plugin wherever it is not business-critical, and for sites where it must remain active, immediately restrict access to the plugin's form submission endpoints and enable WAF or virtual patching rules for SQL injection and PHP object injection while monitoring logs for exploitation attempts. Within 7 days, if the plugin cannot be removed, isolate the affected WordPress instance, apply compensating network controls, validate backups, run malware and integrity scans, and engage the vendor or a WordPress security provider for interim guidance; confirm that no later fixed version is available because no vendor-released patch has been identified at time of analysis. Within 30 days, replace Contact Form CFDB7 with a maintained alternative or re-enable it only after a vendor patch above 1.3.2 is released and tested, complete a compromise assessment, and add the plugin to vulnerability management and patch governance processes.

Contact Form CFDB7 CVE-2025-4665

CRITICAL

SQL Injection (CWE-89)

2025-10-29 mandiant-cve@google.com

PHP WordPress SQLi Deserialization Wordpress Plugin

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Pre-auth, network-reachable, low-complexity SQLi-to-object-injection gives AV:N/AC:L/PR:N; the trigger is attacker-controlled so UI:N (disagreeing with input UI:R), with full CIA impact within the application (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 11:40 vuln.today

CVE Published

Oct 29, 2025 - 00:15 cve.org

CRITICAL 9.6

DescriptionCVE.org

WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injection). The weakness arises due to insufficient validation of user input in plugin endpoints, allowing crafted input to influence backend queries in unexpected ways. Using specially crafted payloads, this can escalate into unsafe deserialization, enabling arbitrary object injection in PHP. Although the issue is remotely exploitable without authentication, it does require a crafted interaction with the affected endpoint in order to trigger successfully.

AnalysisAI

Pre-authentication SQL injection in the WordPress plugin Contact Form CFDB7 (all versions up to and including 1.3.2) cascades into PHP object injection, allowing remote attackers to reach code paths that can fully compromise confidentiality, integrity, and availability of an affected WordPress site. The CVSS vector (AV:N/AC:L/PR:N) confirms the attack is remotely reachable and unauthenticated, and the plugin must simply be installed and active on the target - no valid account or victim action is required in practice. Exploitation status is unconfirmed: there is no CISA KEV entry and no public exploit code identified at time of analysis, and the EPSS score is low at 0.33% (24th percentile), so this appears to be a severe but not yet broadly exploited issue; it was disclosed by Mandiant (MNDT-2025-0006).

Technical ContextAI

The vulnerable component is a WordPress plugin (slug contact-form-cfdb7) that stores contact-form submissions and exposes front-end and AJAX endpoints to unauthenticated visitors. Per CWE-89, user-supplied input reaching those endpoints is not properly validated or parameterized before being used to build backend SQL queries, so crafted values can alter query logic and manipulate what the plugin reads back out of its own tables. The disclosed chain extends beyond classic SQLi: attacker-influenced data flows into PHP's unserialize() handling, producing PHP Object Injection. When a gadget chain exists in the WordPress core, other active plugins, or the theme's autoloaded classes, object injection can escalate to file operations, arbitrary option manipulation, SSRF, or remote code execution. Note a scoring discrepancy worth tracking: NVD rates this 9.6 with UI:R (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), while this assessment treats it as UI:N (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), because the "crafted interaction" described is attacker-side payload construction rather than victim-side user interaction - meaning default installations of the affected plugin should be treated as directly exploitable over the network.

Affected ProductsAI

Contact Form CFDB7, a WordPress plugin, versions up to and including 1.3.2, as distributed through the official WordPress plugin directory (https://wordpress.org/plugins/contact-form-cfdb7). No CPE string was supplied in the available intelligence, so scoping should be done by plugin slug and installed version rather than by CPE matching; any WordPress site with the plugin installed and active at 1.3.2 or earlier is in scope, regardless of WordPress core version. The authoritative technical write-up is Mandiant's vulnerability disclosure MNDT-2025-0006 (https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0006.md), which is also referenced by NVD. Sites that have merely downloaded but not activated the plugin are not exposed until activation.

RemediationAI

No vendor-released patch or fixed version is identified in the available references, so treat this as unpatched at time of analysis and verify current status directly on the plugin's WordPress.org page (https://wordpress.org/plugins/contact-form-cfdb7) and in Mandiant's advisory (https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0006.md). The most reliable mitigation is to deactivate and remove Contact Form CFDB7 from all sites until a version above 1.3.2 ships, accepting the loss of the contact-form/submission-logging functionality and the need to clean up any submission data or migrate to an alternative form plugin. If removal is not operationally possible, restrict access to the plugin's front-end and AJAX endpoints so only trusted networks can reach them (for example, blocking direct requests to the plugin's admin-ajax.php actions and its public submission handlers at the reverse proxy), at the cost of breaking legitimate public form submissions. A WAF or ModSecurity rule set that blocks SQL metacharacters and serialized-object payloads (O: and C: patterns) in requests to the plugin's endpoints reduces exposure but is bypass-prone and does not fix the underlying parameterization flaw, so it should be treated as temporary. Combine these with database-level monitoring for anomalous queries against the plugin's submission tables and a review of PHP object autoloading classes that could serve as gadget chains. The low EPSS (0.33%) and absence of a KEV listing argue for patching on a normal high-severity cycle unless the site is internet-facing with the plugin active.