The vulnerability CVE-2025-60081 in the PDF for Contact Form 7 plugin arises from unsafe deserialization of untrusted data, enabling object injection attacks. This flaw affects all versions up to 6.5.0. The CVSS score of 8.8 reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The plugin is not a cloud service, and no patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or manipulate application data, resulting in full compromise of confidentiality, integrity, and availability of the affected system. Given the high CVSS score and the nature of object injection, the impact is severe if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable plugin and monitor for suspicious activity related to deserialization processes. Avoid exposing the affected plugin to untrusted inputs where possible.