PHP Object Injection Vulnerability in WordPress Plugin by Contact Form 7 and WPForms

CVE-2026-2599

What is CVE-2026-2599?

The Database for Contact Form 7, WPForms, and Elementor forms plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input in the 'download_csv' function. This vulnerability allows unauthenticated attackers to inject PHP objects. Although the vulnerability itself does not pose immediate risks unless combined with other plugins or themes that contain a PHP Object Pollution (POP) chain, it could lead to severe consequences such as arbitrary file deletion, unauthorized data retrieval, or remote code execution when exploited in conjunction with vulnerable components.

References