CVE-2025-7696: Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.3 - Unauthenticated PHP Object Injection via verify_field_val Function
The Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.3 via deserialization of untrusted input within the verifyfieldval() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7696?
CVE-2025-7696 is classified as a critical vulnerability due to the PHP Object Injection risk.
How do I fix CVE-2025-7696?
To fix CVE-2025-7696, update the Integration for Pipedrive and Contact Form 7, WPForms, Elementor, or Ninja Forms plugins to version 1.2.4 or later.
Which versions are affected by CVE-2025-7696?
CVE-2025-7696 affects all versions of the Integration for Pipedrive and Contact Form 7, WPForms, Elementor, and Ninja Forms plugins up to and including version 1.2.3.
What is the impact of CVE-2025-7696?
CVE-2025-7696 allows attackers to exploit PHP Object Injection vulnerabilities, potentially leading to remote code execution.
Is CVE-2025-7696 specific to certain WordPress plugins?
Yes, CVE-2025-7696 specifically affects the Integration for Pipedrive, Contact Form 7, WPForms, Elementor, and Ninja Forms plugins.