CVE-2025-4665
Published
CVSS v3
9.6
CRITICAL
CVSS v2
N/A
Affected
2
PROJECTS
Description
WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injection). The weakness arises due to insufficient validation of user input in plugin endpoints, allowing crafted input to influence backend queries in unexpected ways. Using specially crafted payloads, this can escalate into unsafe deserialization, enabling arbitrary object injection in PHP. Although the issue is remotely exploitable without authentication, it does require a crafted interaction with the affected endpoint in order to trigger successfully.
GitHub<p>The “CFDB7” plugin saves contact form 7 submissions to your WordPress database. Export the data to a CSV file.<br />
By simply installing the plugin, it will automatically begin to capture form submissions from contact form 7.</p>
<h4>Features of CFDB 7</h4>
<ul>
<li>No configuration is needed</li>
<li>Save Contact Form 7 form submitted data to the database.</li>
<li>Single database table for all contact form 7 forms</li>
<li>Easy to use and lightweight plugin</li>
<li>Developer friendly & easy to customize</li>
<li>Display all created contact form 7 form list.</li>
<li>Export CF7 DB (CF7 Database – cf7db) data in CSV file</li>
</ul>
<h4>Form Email Testing Tool</h4>
<ul>
<li><a href="https://mailmug.net" rel="nofollow ugc">MailMug – SMTP Sandbox</a> </li>
</ul>
<h4>Plugins</h4>
<ul>
<li><a href="https://wordpress.org/plugins/postbox-email-logs/" rel="ugc">PostBox Email Log</a></li>
<li><a href="https://wordpress.org/plugins/wp-mail-smtp-mailer/" rel="ugc">WP mail smtp</a></li>
</ul>
<h4>Pro Addons</h4>
<ul>
<li><a href="https://ciphercoin.com/downloads/public-export-csv/" rel="nofollow ugc">Entry Automation</a><br />
Automatically export CFDB7 form entries to CSV on a schedule</li>
<li><a href="https://ciphercoin.com/downloads/contact-form-7-column-base-mysql-database-addon/" rel="nofollow ugc">Advanced MYSQL DB</a><br />
Separate MySQL column for each cf7 input field</li>
<li><a href="https://ciphercoin.com/downloads/excel-xlsx-spreadsheet/" rel="nofollow ugc">Excel Spreadsheet (XLSX) Extension</a><br />
Connect CFDB7 to an external database or another DB</li>
<li><a href="https://ciphercoin.com/downloads/filedrop-contact-form-7/" rel="nofollow ugc">Drag & Drop File Upload</a><br />
Contact form 7 drag and drop files upload plugin.</li>
<li><a href="https://ciphercoin.com/downloads/cfdb7-unique-field/" rel="nofollow ugc">Already Submitted?</a><br />
Trigger error if a field is already submitted</li>
<li><a href="https://ciphercoin.com/downloads/cf7-popup-message/" rel="nofollow ugc">Popup Message</a><br />
Replace your validation and success messages with beautiful popup messages to attract visitors.</li>
<li><a href="https://ciphercoin.com/downloads/cfdb7-export-pdf-addon/" rel="nofollow ugc">Export PDF File</a><br />
Easy to export contact forms from database to PDF file</li>
<li><a href="https://ciphercoin.com/downloads/cfdb7-import-csv-to-database/" rel="nofollow ugc">Import CSV to Database</a><br />
Import data from the CSV file to the CFDB7 database</li>
</ul>
<p>Support : <a href="https://www.ciphercoin.com/contact/" rel="nofollow ugc">http://www.ciphercoin.com/contact/</a><br />
Extensions : <a href="https://ciphercoin.com/contact-form-7-database-cfdb7-add-ons/" rel="nofollow ugc">Contact form 7 more Add-ons</a></p>
WordPress Plugin Directory