CVE-2026-104010

The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field (e.g., your-message)' parameter parameter. This is due to insufficient sanitization of CF7 submission field values before database storage and the absence of an allowed_classes restriction on maybe_unserialize() during admin retrieval. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation of the remote code execution gadget chain requires that a Google Sheets access token be configured in the plugin (its primary advertised feature), as this triggers autoloading of the bundled Monolog 2.10.0 library whose classes form the exploitable gadget chain; however, the underlying PHP Object Injection occurs regardless.

• CWE-502

• https://plugins.trac.wordpress.org/browser/contactsheets-lite/tags/1.8.0/includes/class-wpsslc-google-api-functions.php#L157
• https://plugins.trac.wordpress.org/browser/contactsheets-lite/tags/1.8.0/includes/class-wpsslc-service.php#L114
• https://plugins.trac.wordpress.org/browser/contactsheets-lite/tags/1.8.0/includes/class-wpsslc-service.php#L184
• https://plugins.trac.wordpress.org/browser/contactsheets-lite/tags/1.8.0/includes/entry/class-wpsslc-cf7-entries-table.php#L459
• https://plugins.trac.wordpress.org/browser/contactsheets-lite/tags/1.8.0/includes/entry/class-wpsslc-single-entry.php#L131
• https://plugins.trac.wordpress.org/changeset/3783292/contactsheets-lite/trunk/includes/entry/class-wpsslc-cf7-entries-table.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/366e20df-4cb2-4ba1-93fd-11552faa1a32?source=cve

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104001The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automa…5.4
• CVE-2026-104002A fail-open error handling issue within the data masking uti…5.3
• CVE-2026-104003The WP User Avatar / ProfilePress plugin for WordPress is vu…5.4
• CVE-2026-104004MongoDB Server's collection validation feature may not prope…6.5
• CVE-2026-104005A security issue was discovered in MongoDB mongos (the shard…6.5
• CVE-2026-104006The SpeedyCache – Cache, Optimization, Performance plugin fo…3.7
• CVE-2026-104011Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-104012The Rox Appointment Booking – Appointment Booking Scheduling…8.8
• CVE-2026-104016ProtobufParser parses length-prefixed protobuf string and by…7.5
• CVE-2026-104018An improper privilege management vulnerability (CWE-269) exi…8.8
• CVE-2026-104019OS command injection in the Studio Space startup validation …9
• CVE-2026-104020Uncontrolled recursion in the Ion reader in Amazon Ion Pytho…7.5