CVE-2025-7384

CVE-2025-7384 — PHP 对象注入到远程代码执行（RCE） 插件： Database for Contact Form 7 contact-form-entries ≤ 1.4.3 CVSS： 9.8（严重） CWE： CWE-502 — 不可信数据反序列化 认证要求： 无（未认证） 影响： 远程代码执行 目录 1. 漏洞概述 2. 相关概念 3. 根因分析（源码 + 调试） 4. 攻击链 5. 分步复现（POC） 6. 影响评估 7. 修复措施 1. 漏洞概述 “Database for Contact Form...

CVE-2026-7647

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...

CVE-2026-7647

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...

CVE-2026-2471 WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field

The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the BaseModel class constructor calling maybeunserialize on all properties retrieved...

The vulnerability of the maybe_unserialize() function in the Gravity Forms plugin for WordPress content management system allows a hacker to gain access to read, modify, or delete files, or execute arbitrary code.

The vulnerability of the maybeunserialize function in the Gravity Forms plugin of the WordPress content management system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to gain read, modify, or delete access to files, or execute...

Cross site request forgery (csrf)

The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its deletecf7data and exportcf7data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The...