CF7 Database Plugin CVE-2026-12081

The target site must be running the 'Database for Contact Form 7, WPforms, Elementor forms' plugin in a version prior to 1.5.2, with at least one publicly accessible form (Contact Form 7, WPForms, or Elementor Forms) configured to have submissions captured by the plugin. The specific vulnerable code path is the entry-editor file-field deserialization route - prior patches for CVE-2025-7384 and CVE-2026-2599 hardened other paths, so this condition is distinct. A site administrator must subsequently open the entry editor and view the stored submission for the payload to trigger (UI:R). The actual post-deserialization impact depends on the availability of usable PHP gadget chains contributed by other installed plugins or WordPress core; without a viable gadget chain, exploitation may be limited to denial of service or low-impact object manipulation. Exploitation is bounded by the requirement for admin interaction and the presence of exploitable gadget chains, neither of which is guaranteed.

The NVD CVSS 3.1 base score of 5.0 (Medium) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L accurately reflects the two-stage exploitation requirement: AC:H acknowledges that administrator interaction (UI:R) is necessary to trigger the stored payload, which is a genuine dependency outside attacker control. However, the C:L/I:L/A:L impact ratings may materially understate real-world risk - PHP object injection in WordPress environments often enables full remote code execution via gadget chains contributed by co-installed plugins or WordPress core libraries, and CVSS base metrics cannot account for this environmental escalation. A publicly available exploit exists (per WPScan), which elevates practical exploitation likelihood beyond what a Medium base score implies. EPSS data was not provided, so exploitation probability cannot be quantified from that signal. No CISA KEV listing is present, meaning confirmed active exploitation is not established at time of analysis. The AC:H rating should not cause defenders to deprioritize this: administrator review of form submissions is a routine, frequent action in sites using this plugin, making the UI:R trigger condition reliably achievable in practice.

An unauthenticated attacker submits a contact form on the target WordPress site with a crafted serialized PHP object embedded in the file-field input; the plugin stores this value unsanitized in the database. When a site administrator subsequently opens the entry editor to review the submission - a routine administrative task - the plugin deserializes the stored file-field value, instantiating the attacker's PHP object and invoking its magic methods, which may execute arbitrary code server-side depending on gadget chains available in the WordPress installation. A publicly available exploit exists, lowering the skill threshold for this attack.