Skip to main content

PHP CVE-2026-2599

CRITICAL
Deserialization of Untrusted Data (CWE-502)
2026-03-05 security@wordfence.com
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Re-analysis Queued
Apr 22, 2026 - 21:37 vuln.today
cvss_changed
Analysis Generated
Mar 12, 2026 - 22:06 vuln.today
CVE Published
Mar 05, 2026 - 13:16 nvd
CRITICAL 9.8

DescriptionCVE.org

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'download_csv' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

AnalysisAI

PHP Object Injection in Database for CF7/WPforms/Elementor forms WordPress plugin.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send crafted request to download_csv endpoint
Delivery
Trigger PHP object deserialization
Exploit
Inject malicious serialized object
Execution
Activate POP chain in installed plugin
Impact
Execute arbitrary code

Vulnerability AssessmentAI

Exploitation Vulnerable form plugin (version ≤1.4.7) installed and active; additional plugin or theme with exploitable POP chain present on WordPress installation; download_csv endpoint accessible to unauthenticated users. Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 9.8. Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Object injection via form data.
Remediation Update. Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all affected WordPress installations running vulnerable plugin versions and disable the CSV download functionality if operationally feasible, or restrict access to authenticated administrators only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-2599 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy