CyberRota Analysis
AI-GeneratedThe vulnerability affects the Database for Contact Form 7, WPforms, and Elementor forms plugins for WordPress prior to version 1.5.2, allowing unauthenticated users to inject arbitrary PHP objects through unserialization of form-field values. This can lead to remote code execution when an administrator views the stored entries, posing a significant risk to site integrity. WordPress site administrators using these plugins should prioritize updating to the latest version to mitigate potential exploitation.
Original NVD Description
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.