PT-2025-30114 · WordPress+1 · Pipedrive/Contact Form 7+1

Phat Rio

·

Published

2025-07-19

·

Updated

2025-07-24

·

CVE-2025-7696

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress versions up to and including 1.2.3
Description The Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input within the verify field val() function. This allows unauthenticated attackers to inject a PHP Object. The presence of a POP chain in the Contact Form 7 plugin, when used alongside, may allow attackers to delete arbitrary files, potentially leading to a denial of service or remote code execution if the wp-config.php file is deleted.
Recommendations Update the Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress to a version later than 1.2.3.

Fix

DoS

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-7696

Affected Products

Contact Form 7
Pipedrive/Contact Form 7