Introduction
Attackers can remotely delete critical files like wp-config.php on over 70,000 WordPress sites, which can lead to full site compromise and administrative takeover. CVE-2025-7384 affects the widely used Database for Contact Form 7, WPforms, Elementor forms plugin, which stores and manages form submissions from several popular WordPress form builders.
Technical information
CVE-2025-7384 is a PHP Object Injection vulnerability in all versions of the Database for Contact Form 7, WPforms, Elementor forms plugin up to and including 1.4.3. The root cause is unsafe deserialization of untrusted user input in the get_lead_detail function. The plugin unserializes user-supplied data without validating or sanitizing it, so an attacker can inject arbitrary PHP objects.
When Contact Form 7 is installed alongside the vulnerable plugin, its classes provide a property-oriented programming (POP) chain that attackers can use to delete arbitrary files. With a crafted serialized payload that triggers the POP chain, an unauthenticated attacker can delete any file the web server user can access, including wp-config.php. Deleting that file forces WordPress into its installation routine, and the attacker can then reconfigure the site and gain administrative access. The attack needs no authentication and works remotely.
The vulnerable code is publicly referenced at https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.1/includes/data.php#L525.
The vulnerability is classified as CWE-502: Deserialization of Untrusted Data.
Affected systems and versions
- Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress
- All versions up to and including 1.4.3 are vulnerable
- Sites running both this plugin and Contact Form 7 are at higher risk, because Contact Form 7 supplies a usable POP chain
Vendor security history
CRM Perks, the vendor behind this plugin, has had critical vulnerabilities across its WordPress plugins before. Recent issues include:
- CVE-2025-7697: PHP Object Injection in Google Sheets integration plugin
- Multiple SQL injection and XSS vulnerabilities in CRM Perks Forms
CRM Perks typically releases patches within about a week of disclosure, but the repeated high-severity flaws suggest ongoing problems with secure coding and review.
