This vulnerability (CVE-2025-7384) affects the Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress, specifically versions up to and including 1.4.3. It arises from unsafe deserialization of untrusted data in the get_lead_detail function, enabling PHP Object Injection by unauthenticated attackers. The presence of a POP chain in the Contact Form 7 plugin can be leveraged to delete arbitrary files such as wp-config.php, resulting in denial of service or remote code execution. The CVSS 3.1 base score is 9.8, reflecting its critical impact with network attack vector, no privileges or user interaction required, and high confidentiality, integrity, and availability impacts.

Successful exploitation allows unauthenticated attackers to inject PHP objects, leading to arbitrary file deletion including critical configuration files like wp-config.php. This can cause denial of service or enable remote code execution, severely compromising the affected WordPress site’s confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates and apply any official fixes promptly once released.