CVE-2026-2599
PHP Object Injection in Contact Form 7 Database Plugin
Publication date: 2026-03-05
Last updated on: 2026-03-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| crm_perks | contact_form_entries | to 1.4.7 (inc) |
| crm_perks | contact_form_entries | From 1.4.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is a PHP Object Injection issue present in all versions up to and including 1.4.7. It occurs via deserialization of untrusted input in the 'download_csv' function.
This means that an unauthenticated attacker can inject a PHP object during the deserialization process. However, the vulnerability itself has no direct impact unless another plugin or theme containing a POP (Property Oriented Programming) chain is installed on the site.
If such a POP chain exists through an additional plugin or theme, the attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to perform dangerous actions such as deleting arbitrary files, retrieving sensitive data, or executing arbitrary code on the affected WordPress site.
However, exploitation requires the presence of a POP chain in another installed plugin or theme, as the vulnerable plugin alone does not contain a POP chain.
The vulnerability is exploitable by unauthenticated attackers via the 'download_csv' function, making it a high-severity risk with a CVSS score of 9.8.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability affects the Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress in versions up to and including 1.4.7. Detection involves identifying if the vulnerable plugin version is installed and if the 'download_csv' function is accessible."}, {'type': 'paragraph', 'content': 'You can detect the presence of the vulnerable plugin version by checking the installed WordPress plugins list or by querying the plugin files on your system.'}, {'type': 'list_item', 'content': "On the server hosting WordPress, run a command to check the plugin version, for example: `grep 'Version:' wp-content/plugins/contact-form-entries/contact-form-entries.php`"}, {'type': 'list_item', 'content': 'Check for the presence of the vulnerable GET parameter by monitoring web server logs for requests containing `vx_crm_form_action=download_csv`.'}, {'type': 'list_item', 'content': "Use network monitoring tools or web application firewalls to detect suspicious requests attempting to exploit the deserialization vulnerability via the 'download_csv' function."}, {'type': 'paragraph', 'content': 'No specific detection commands or signatures are provided in the available resources.'}] [2, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': "The primary mitigation step is to update the Contact Form Entries plugin to version 1.4.8 or later, where the PHP Object Injection vulnerability via the 'download_csv' function has been fixed."}, {'type': 'paragraph', 'content': 'The fix involves safer handling of serialized data by replacing the unsafe `maybe_unserialize()` call with a secure method `vxcf_form::maybe_unserialize()`, preventing unsafe PHP object deserialization.'}, {'type': 'list_item', 'content': 'Update the plugin through the WordPress admin dashboard or manually replace the plugin files with version 1.4.8 or newer.'}, {'type': 'list_item', 'content': "If immediate update is not possible, restrict access to the 'download_csv' functionality by limiting access to authenticated users or blocking the relevant GET parameter via web server or firewall rules."}, {'type': 'list_item', 'content': 'Review installed plugins and themes for potential POP chains that could be exploited in conjunction with this vulnerability.'}] [3]