What the vulnerability does
01Description
WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injection). The weakness arises due to insufficient validation of user input in plugin endpoints, allowing crafted input to influence backend queries in unexpected ways. Using specially crafted payloads, this can escalate into unsafe deserialization, enabling arbitrary object injection in PHP. Although the issue is remotely exploitable without authentication, it does require a crafted interaction with the affected endpoint in order to trigger successfully.
Explanation of Vulnerability in Simple Terms
02Summary
CFDB7 versions up to 1.3.2 contain a SQL injection vulnerability in database query handling. An attacker can craft a malicious link or form submission that executes arbitrary SQL commands on the site's database. The vulnerability requires user interaction—the victim must click a link or submit a form—but can lead to unauthorized data access, modification, or deletion. All site data is at risk.
What an attacker can do
03Attacker Capabilities
Execute arbitrary SQL commands to read, modify, or delete database records.
Potential impact on your site
04Site Impact
Database contents (posts, users, settings, form submissions) can be stolen, altered, or destroyed.
Conditions required to exploit
05Prerequisites
Victim must click a malicious link or submit a crafted form; no authentication required.
Key dates
06Disclosure timeline
October 28, 2025
CVE published
October 29, 2025
Record updated
