PHP Object Injection Vulnerability in Integration for Google Sheets and Contact Form 7 Plugin by WordPress

CVE-2025-7697

What is CVE-2025-7697?

The Integration for Google Sheets and Contact Form 7 plugin for WordPress is susceptible to PHP Object Injection due to insecure deserialization of unchecked user input within the verify_field_val() function. All versions up to and including 1.1.1 are affected, allowing unauthenticated attackers to exploit this vulnerability. The associated risk is exacerbated by a possible chain of vulnerabilities in the Contact Form 7 plugin, which could enable attackers to delete critical files, such as the wp-config.php file, potentially resulting in denial of service or even remote code execution.

References