blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2025-4665

CRITICAL 9.6 CVSS 3.1
Published
October 29, 2025
Last modified
October 8, 2026
NVD status
Deferred
Reported by
mandiant-cve@google.com
Weakness
CWE-89
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Description

WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injection). The weakness arises due to insufficient validation of user input in plugin endpoints, allowing crafted input to influence backend queries in unexpected ways. Using specially crafted payloads, this can escalate into unsafe deserialization, enabling arbitrary object injection in PHP. Although the issue is remotely exploitable without authentication, it does require a crafted interaction with the affected endpoint in order to trigger successfully.

Affected WordPress components

  • Database Addon for Contact Form 7 – CFDB7 Plugin · contact-form-cfdb7
    Confirmed match Active
    From 0.0.0 (including) to 1.3.2 (including)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • WordPress Contact Form 7 Database Addon CFDB7 By Arshid CFDB7 — From 0.0.0 (including) to 1.3.2 (including)

References

  • github.com https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0006.md
  • wordpress.org https://wordpress.org/plugins/contact-form-cfdb7
  • nvd.nist.gov Official NVD record