CVE-2025-7697: WordPress Google Sheets Integration RCE Flaw

CVE-2025-7697 Overview

CVE-2025-7697 is a PHP Object Injection vulnerability affecting the Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress. All versions up to and including 1.1.1 are affected. The flaw resides in the verify_field_val() function, which deserializes untrusted input without validation. Unauthenticated attackers can inject crafted PHP objects through this entry point. When combined with a Property Oriented Programming (POP) chain present in the Contact Form 7 plugin, attackers can delete arbitrary files. Deleting wp-config.php triggers WordPress reinstallation flows, enabling remote code execution or denial of service. The vulnerability is classified under [CWE-502: Deserialization of Untrusted Data].

Critical Impact
Unauthenticated attackers can achieve remote code execution by chaining PHP Object Injection with Contact Form 7 to delete wp-config.php.

Affected Products

Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms (WordPress plugin)
Versions up to and including 1.1.1
WordPress installations using this plugin alongside Contact Form 7

Discovery Timeline

2025-07-19 - CVE-2025-7697 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-7697

Vulnerability Analysis

The vulnerability is rooted in unsafe deserialization within the plugin's verify_field_val() function. When the function receives form submission data, it passes attacker-controlled input directly to PHP's unserialize() without sanitization or type checking. PHP deserialization reconstructs objects and invokes magic methods such as __wakeup() and __destruct() during this process. An attacker who supplies a serialized payload referencing classes available in the application can trigger arbitrary method calls on attacker-defined object states.

The Integration for Google Sheets plugin alone does not include exploitable gadgets, but Contact Form 7 — listed as a primary integration target — contains a usable POP chain. This chain enables attackers to invoke file deletion routines using attacker-controlled paths. Deleting wp-config.php causes WordPress to enter installation mode, where an attacker can supply database credentials pointing to an attacker-controlled server, ultimately achieving code execution under the web server user context.

Root Cause

The root cause is the use of PHP unserialize() on attacker-controlled input within verify_field_val(). The function fails to validate that incoming data is well-formed JSON or expected scalar input before passing it to the deserialization routine. No allowed_classes parameter is supplied, leaving all loaded classes available as deserialization targets.

Attack Vector

An unauthenticated remote attacker submits a crafted form payload containing a serialized PHP object. The payload reaches verify_field_val() over HTTP, where deserialization instantiates the malicious object and triggers the Contact Form 7 POP chain. The chain executes file operations leading to deletion of wp-config.php and subsequent site takeover. No authentication, user interaction, or special privileges are required.

Detailed code references are available in the WordPress Plugin Code Reference and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-7697

Indicators of Compromise

POST requests to plugin endpoints containing serialized PHP payloads beginning with O: or a: patterns in form field values
Missing or recently deleted wp-config.php file on the WordPress filesystem
Unexpected WordPress installation prompts presented to site visitors
Web server error logs referencing unserialize() warnings or unexpected class instantiation

Detection Strategies

Inspect HTTP request bodies for serialized object signatures targeting plugin form handlers
Monitor filesystem integrity for changes or deletions affecting wp-config.php and other critical WordPress files
Review web access logs for anomalous POST volumes against contact form submission endpoints
Correlate plugin version data against the vulnerable range up to 1.1.1

Monitoring Recommendations

Enable PHP error logging to capture deserialization warnings and __destruct() exceptions
Deploy a web application firewall (WAF) rule set capable of identifying PHP serialized payload patterns in request parameters
Track plugin inventory across WordPress deployments and alert on installations of the vulnerable plugin combined with Contact Form 7

How to Mitigate CVE-2025-7697

Immediate Actions Required

Update the Integration for Google Sheets and Contact Form 7 plugin to a version above 1.1.1 immediately
Audit all WordPress sites for the presence of this plugin combined with Contact Form 7
Back up wp-config.php and database credentials before patching to enable rapid recovery if compromise is suspected
Rotate database credentials and WordPress salts if any indicator of exploitation is detected

Patch Information

The plugin maintainers addressed the vulnerability in the changeset published at the WordPress Changeset Update. Site administrators should update through the WordPress plugin dashboard or by downloading the fixed release from the WordPress Developer Information page.

Workarounds

Deactivate and remove the vulnerable plugin until patching is possible
Restrict access to form submission endpoints using WAF rules that block serialized PHP payloads in request bodies
Apply filesystem permissions that prevent the web server user from deleting wp-config.php
Move wp-config.php one directory above the WordPress root so it falls outside attacker-reachable paths

bash

# Restrict write/delete permissions on wp-config.php
chown root:www-data /path/to/wordpress/wp-config.php
chmod 440 /path/to/wordpress/wp-config.php

# Verify plugin version and remove if vulnerable
wp plugin get integration-for-contact-form-7-and-google-sheets --field=version
wp plugin deactivate integration-for-contact-form-7-and-google-sheets
wp plugin delete integration-for-contact-form-7-and-google-sheets