PT-2025-30115 · Unknown+1 · Contact Form 7+1

Phat Rio · Published 2025-07-16 · Updated 2025-07-24 · CVE-2025-7697

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress versions up to and including 1.1.1

Description The plugin is susceptible to PHP Object Injection due to deserialization of untrusted input within the verify field val() function. This allows unauthenticated attackers to inject a PHP Object. The presence of a POP chain in the Contact Form 7 plugin, often used in conjunction with the vulnerable plugin, enables attackers to delete arbitrary files, potentially leading to a denial of service or remote code execution if the wp-config.php file is deleted.

Recommendations Versions up to and including 1.1.1 are affected. Update the Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress to a version newer than 1.1.1.

Fix

DoS

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-16387

CVE-2025-7697

Affected Products

Contact Form 7

Integration For Google Sheets/Contact Form 7

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-7697 · Security Note
• https://bdu.fstec.ru/vul/2025-16387 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a0146f17-35bd-45cf-b9c6-c4fce688efc2?source=cve · Note
• https://t.me/cvetracker/28194 · Telegram Post
• https://twitter.com/CVEnew/status/1946433095655129556 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3329005 · Note
• https://twitter.com/VulmonFeeds/status/1946441930180616357 · Twitter Post
• https://wordpress.org/plugins/integration-for-contact-form-7-and-google-sheets/#%D1%80%D0%B0%D0%B7%D1%80%D0%B0%D0%B1%D0%BE%D1%82%D1%87%D0%B8%D0%BA%D0%B8 · Note
• https://t.me/cvenotify/129532 · Telegram Post
• https://plugins.trac.wordpress.org/browser/integration-for-contact-form-7-and-google-sheets/tags/1.1.1/integration-for-contact-form-7-and-google-sheets.php#L923 · Note
• https://wordpress.org/plugins/integration-for-contact-form-7-and-google-sheets/#developers · Note
• https://twitter.com/cracbot/status/1948337401686106317 · Twitter Post