This vulnerability (CVE-2025-7696) affects the Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms WordPress plugin up to version 1.2.3. It arises from unsafe deserialization of untrusted data in the verify_field_val() function, enabling PHP Object Injection by unauthenticated attackers. The presence of a POP chain in the Contact Form 7 plugin, commonly used alongside this integration, can be exploited to delete arbitrary files such as wp-config.php. This deletion can result in denial of service or remote code execution. The CVSS 3.1 base score is 9.8, reflecting critical impact with network attack vector, no privileges or user interaction required, and high confidentiality, integrity, and availability impacts.

Successful exploitation allows unauthenticated attackers to inject PHP objects, leading to arbitrary file deletion including critical files like wp-config.php. This can cause denial of service or enable remote code execution, severely compromising the affected WordPress site’s confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, avoid using affected plugin versions and monitor vendor channels for updates. Consider disabling or removing the vulnerable plugin to prevent exploitation.