CVE-2025-7384

🗓️ 13 Aug 2025 04:22:56Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 75 Views

WordPress form plugins expose unauthenticated PHP object injection via deserialization in get_lead_detail; Contact Form 7 POP chain allows wp-config.php deletion, causing DoS or remote code execution

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-7384	13 Aug 202505:59	–	circl
CNNVD	WordPress plugin Database for Contact Form 7, WPforms, Elementor forms 代码问题漏洞	13 Aug 202500:00	–	cnnvd
Cvelist	CVE-2025-7384 Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion	13 Aug 202504:22	–	cvelist
EUVD	EUVD-2025-24539	3 Oct 202520:07	–	euvd
NVD	CVE-2025-7384	13 Aug 202505:15	–	nvd
Patchstack	WordPress Database for Contact Form 7, WPforms, Elementor forms plugin <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion vulnerability	31 Dec 202500:00	–	patchstack
Positive Technologies	PT-2025-32965	13 Aug 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-7384	15 Aug 202504:34	–	redhatcve
The Hacker News	⚡ Weekly Recap: NFC Fraud, Curly COMrades, N-able Exploits, Docker Backdoors & More	18 Aug 202512:47	–	thn
Vulnrichment	CVE-2025-7384 Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion	13 Aug 202504:22	–	vulnrichment

Vulners

Node

crmperks database_for_contact_form_7,_wpforms,_elementor_formsRange≤1.4.3wordpress

[
  {
    "vendor": "crmperks",
    "product": "Database for Contact Form 7, WPforms, Elementor forms",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.4.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/129f810d-ff83-4428-9f98-6a6aa8817783
plugins	www.plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.1/includes/data.php
plugins	www.plugins.trac.wordpress.org/changeset/3338764/

17 Jun 2026 10:04Current

8.7High risk

Vulners AI Score8.7

CVSS 3.19.8

EPSS0.01589

SSVC

CWE-502