EUVD-2026-43286
GHSA-qq2h-g46x-whfp
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Network form submission is unauthenticated (AV:N, PR:N), but admin must view the stored entry to trigger deserialization (UI:R, AC:H); limited impact without a confirmed gadget chain (C:L/I:L/A:L).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.
AnalysisAI
PHP object injection in the 'Database for Contact Form 7, WPforms, Elementor forms' WordPress plugin (all versions before 1.5.2) permits unauthenticated attackers to embed malicious serialized PHP objects via the entry-editor file-field path, which are instantiated server-side when an administrator views the stored form entry. This is an incomplete remediation of two prior CVEs (CVE-2025-7384 and CVE-2026-2599) - earlier patches hardened other deserialization paths within the same plugin while this specific code route was overlooked. A publicly available exploit exists; no active exploitation is confirmed by CISA KEV at time of analysis.
Technical ContextAI
The affected plugin aggregates form submissions from Contact Form 7, WPForms, and Elementor Forms into a WordPress database table for administrator review. The root cause is PHP's native unserialize() function being called on attacker-supplied form data - specifically the file-field input in the entry editor - without restricting which PHP classes may be instantiated. When an arbitrary PHP object is injected and later deserialized, PHP automatically invokes magic methods (__wakeup, __destruct, __toString) on the resulting object, enabling arbitrary code paths to execute. This class of flaw maps to CWE-502 (Deserialization of Untrusted Data), though the CWE field in the source data is listed as N/A. Affected product is identified via CPE cpe:2.3:a:unknown:database_for_contact_form_7,_wpforms,_elementor_forms:*:*:*:*:*:*:*:*. Prior remediation attempts for the same deserialization surface in CVE-2025-7384 and CVE-2026-2599 demonstrate a pattern of piecemeal patching rather than a comprehensive audit of all deserialization paths.
RemediationAI
The primary fix is to update the 'Database for Contact Form 7, WPforms, Elementor forms' plugin to version 1.5.2 or later via the WordPress plugin repository; this is the vendor-released patch that closes the entry-editor file-field deserialization path. Sites that previously patched for CVE-2025-7384 or CVE-2026-2599 are still vulnerable and must apply this additional update. If immediate patching is not feasible, restrict the WordPress roles permitted to view stored form entries to the minimum necessary administrators, reducing the likelihood that an attacker-controlled payload will be triggered - note this does not eliminate the stored payload already in the database. Consider auditing recently stored form entries for anomalous binary or base64-encoded content in file-field values prior to any administrator review. The WPScan advisory at https://wpscan.com/vulnerability/91d0baf4-1052-4666-a28b-34689e06cbab/ should be consulted to verify patch completeness.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today