PHP Object Injection Vulnerability in Integration for Pipedrive and Contact Form 7 Plugin by WordPress

CVE-2025-7696

What is CVE-2025-7696?

The Integration for Pipedrive and Contact Form 7 plugin for WordPress is susceptible to PHP Object Injection due to the unsafe deserialization of untrusted input within the verify_field_val() function. This flaw affects all versions up to and including 1.2.3. Attackers can exploit this vulnerability to inject PHP Objects, potentially allowing for arbitrary file deletion through the presence of a PHP Object Pollution (POP) chain in the accompanying Contact Form 7 plugin. Such actions could lead to critical disruptions including Denial of Service (DoS) or remote code execution, particularly if the wp-config.php file is compromised.

References