This vulnerability (CVE-2025-7697) affects the crmperks Integration plugin for Google Sheets and popular WordPress form plugins up to version 1.1.1. It arises from unsafe deserialization of untrusted data in the verify_field_val() function, enabling PHP Object Injection without authentication. The presence of a POP chain in the Contact Form 7 plugin can be leveraged to delete critical files such as wp-config.php, potentially causing denial of service or enabling remote code execution. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to inject PHP objects leading to arbitrary file deletion, including wp-config.php. This can cause denial of service by breaking the WordPress site or enable remote code execution, compromising the server. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided at this time. Until a patch is available, it is recommended to restrict access to the vulnerable plugin, disable or remove the Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin if possible, and monitor for updates from the vendor. Avoid using untrusted input that triggers deserialization in the verify_field_val() function.