CVE-2025-7384

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.

• CWE-502

• https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.1/includes/data.php#L525
• https://plugins.trac.wordpress.org/changeset/3338764/#file9
• https://www.wordfence.com/threat-intel/vulnerabilities/id/129f810d-ff83-4428-9f98-6a6aa8817783?source=cve

Published

Aug 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-7378An improper Input Validation vulnerability allows injecting …6
• CVE-2025-7379A security bypass vulnerability allows exploitation via Reve…5.2
• CVE-2025-7380A stored Cross-Site Scripting (XSS) vulnerability exists in …4.8
• CVE-2025-7381ImpactThis is an information disclosure vulnerability origin…5.3
• CVE-2025-7382A command injection vulnerability in WebAdmin of Sophos Fire…8.8
• CVE-2025-7383Padding oracle attack vulnerability in Oberon microsystem AG…5.9
• CVE-2025-7385Input from search query parameter in GOV CMS is not sanitize…9.3
• CVE-2025-7386Information exposure vulnerability in Hitachi Storage Naviga…6.8
• CVE-2025-7387The Lana Downloads Manager plugin for WordPress is vulnerabl…5.5
• CVE-2025-7388It was possible to perform Remote Command Execution (RCE) vi…8.4
• CVE-2025-7389A vulnerability in the AdminServer component of OpenEdge on …8.2
• CVE-2025-7390A malicious client can bypass the client certificate trust c…9.1