CVE-2026-12081
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before version 1.5.2 does not restrict allowed PHP classes when unserializing an attacker-supplied form-field value. This allows unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.
Risk Assessment
The risk involves potential remote code execution by an unauthenticated attacker, which could lead to full compromise of the WordPress site, data theft, or further propagation of the attack within the infrastructure.
Recommendation
Immediately update the Database for Contact Form 7, WPforms, Elementor forms plugin to version 1.5.2 or later, which includes complete protection against PHP object deserialization.
Other vulnerabilities in Database for Contact Form 7, WPforms, Elementor forms
See all- CVE-2026-14872Medium
SQL Injection vulnerability in the WordPress plugin 'Database for Contact Form 7, WPforms, Elementor forms' before version 1.5.5. A parameter is not properly sanitized and escaped before being used in a SQL statement, allowing SQL injection by users with a specific capability (default administrators, but can be delegated).
- CVE-2026-14870High
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before version 1.5.3 does not properly sanitize and escape a parameter before reflecting it back in an admin page. This leads to a Reflected Cross-Site Scripting (XSS) that could be used against high-privilege users such as admins.
- CVE-2026-9145Medium
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress up to version 1.5.1 contains an arbitrary file copy vulnerability. The create_entry_el() function passes the raw_value from Elementor Pro's Form_Record object directly to PHP's copy() without validation, allowing an attacker to copy any file from the server or from an external URL.
Original NVD description (English source)
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.