Remote Code Execution Vulnerability in WPSyncSheets For Contact Form 7 Plugin by WordPress

CVE-2026-104010

What is CVE-2026-104010?

The WPSyncSheets For Contact Form 7 plugin for WordPress is exposed to a vulnerability that allows unauthenticated attackers to execute arbitrary code on the server. This is primarily due to inadequate sanitization of custom form field submissions, coupled with a missing restrictions mechanism on the unserialize function during admin data retrieval. Attackers can exploit this flaw if a Google Sheets access token is configured within the plugin, triggering the loading of vulnerable Monolog library classes that facilitate code execution. As a consequence, any website using versions up to 1.8.0 may be at risk, emphasizing the need for prompt updates and security reviews.

References