PT-2026-23447 · WordPress · Elementor Forms Plugin+2

Chiao-Lin Yu

·

Published

2026-03-05

·

Updated

2026-03-26

·

CVE-2026-2599

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress versions up to and including 1.4.7
Description The plugin is susceptible to PHP Object Injection due to deserialization of untrusted input within the download csv function. This allows unauthenticated attackers to inject a PHP Object. The impact of this issue is limited unless another plugin or theme containing a PHP Object Payload (POP) chain is installed on the same site. If a POP chain is present, an attacker may be able to perform actions such as deleting arbitrary files, retrieving sensitive data, or executing code.
Recommendations Versions prior to 1.4.7 should be updated. As a temporary workaround, consider restricting access to the download csv function until a patch is available.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-2599

Affected Products

Database For Contact Form 7
Elementor Forms Plugin
Wpforms