CVE-2025-7384: WordPress Database Plugin RCE Vulnerability

CVE-2025-7384 Overview

CVE-2025-7384 is a critical PHP Object Injection vulnerability affecting the Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress in all versions up to and including 1.4.3. The vulnerability exists due to insecure deserialization of untrusted input in the get_lead_detail function, allowing unauthenticated attackers to inject arbitrary PHP objects.

Critical Impact

Unauthenticated attackers can leverage this vulnerability to achieve remote code execution or denial of service by exploiting an available POP chain in the Contact Form 7 plugin, which is commonly deployed alongside the vulnerable plugin.

Affected Products

• Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress versions ≤ 1.4.3
• WordPress sites utilizing Contact Form 7 plugin (POP chain dependency)
• Elementor forms integration components

Discovery Timeline

• August 13, 2025 - CVE-2025-7384 published to NVD
• August 13, 2025 - Last updated in NVD database

Technical Details for CVE-2025-7384

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The get_lead_detail function within the data.php file processes user-supplied input without proper validation, allowing attackers to pass serialized PHP objects that are then deserialized by the application.

The exploitation potential is significantly amplified by the presence of a Property-Oriented Programming (POP) chain within the Contact Form 7 plugin. This chain provides the necessary gadgets for attackers to transform the object injection into actionable attacks. When exploited, attackers can delete arbitrary files on the server, including critical WordPress configuration files like wp-config.php.

The deletion of wp-config.php triggers WordPress's installation wizard, potentially allowing attackers to reconfigure the site with their own database credentials and achieve complete site takeover.

Root Cause

The root cause lies in the insecure implementation of the get_lead_detail function located in includes/data.php. The function accepts serialized data from user input and passes it directly to PHP's unserialize() function without implementing proper type checking, allowlisting of acceptable classes, or input sanitization. This design flaw violates secure coding practices for handling serialized data.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication. Attackers can craft malicious serialized PHP objects and submit them to the vulnerable endpoint. The attack flow involves:

1. Identifying WordPress sites running the vulnerable plugin version
2. Crafting a serialized payload containing malicious PHP objects
3. Leveraging the POP chain available in Contact Form 7 to chain gadgets
4. Executing arbitrary file operations, including deletion of wp-config.php
5. Optionally triggering WordPress reinstallation for complete site compromise

The vulnerability requires no user interaction and can be exploited remotely with low complexity, making it particularly dangerous for exposed WordPress installations.

Detection Methods for CVE-2025-7384

Indicators of Compromise

• Unexpected HTTP requests targeting form submission endpoints with serialized PHP data
• Deletion or modification of wp-config.php or other critical WordPress files
• WordPress site reverting to installation wizard unexpectedly
• Unusual file system activity in the WordPress root directory
• Web server error logs showing deserialization-related PHP errors

Detection Strategies

• Monitor web application firewall (WAF) logs for serialized PHP object patterns in request parameters
• Implement file integrity monitoring for critical WordPress configuration files
• Deploy intrusion detection rules to identify PHP object injection payloads in HTTP traffic
• Review access logs for unusual POST requests to Contact Form 7 related endpoints
• Scan for plugin versions using WordPress security scanning tools

Monitoring Recommendations

• Enable detailed logging for the WordPress plugins directory and core files
• Configure alerts for any modifications to wp-config.php and related configuration files
• Implement real-time monitoring of web server access logs for suspicious serialized data patterns
• Deploy endpoint detection and response (EDR) solutions to monitor for post-exploitation activity

How to Mitigate CVE-2025-7384

Immediate Actions Required

• Update the Database for Contact Form 7, WPforms, Elementor forms plugin to a version higher than 1.4.3
• Review WordPress installations for signs of compromise, including unexpected file modifications
• Implement WAF rules to block serialized PHP object injection attempts
• Consider temporarily disabling the vulnerable plugin until the patch is applied
• Audit Contact Form 7 plugin configurations and ensure it is also updated to the latest version

Patch Information

The vulnerability has been addressed in the plugin update tracked in WordPress Changeset 3338764. Administrators should update the plugin through the WordPress admin panel or manually download the patched version from the WordPress plugin repository. The vulnerable code in includes/data.php has been remediated to properly validate input before deserialization.

For additional technical details, refer to the Wordfence Vulnerability Report and the vulnerable code location.

Workarounds

• Deploy a web application firewall with rules specifically designed to detect and block PHP serialized object patterns
• Implement server-level input filtering to reject requests containing serialized PHP data
• Restrict access to WordPress admin and plugin endpoints using IP allowlisting where feasible
• Enable PHP disable_functions to limit dangerous functions that may be leveraged by POP chains
• Back up wp-config.php and critical files regularly to facilitate rapid recovery if compromise occurs

# Configuration example - WordPress .htaccess rule to block serialized object patterns
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (O:[0-9]+:) [NC,OR]
    RewriteCond %{REQUEST_BODY} (O:[0-9]+:) [NC]
    RewriteRule .* - [F,L]
</IfModule>