Loading vulnerability…
CVE-2025-4665 is a critical pre-authentication SQL injection vulnerability affecting the WordPress plugin Contact Form CFDB7 up to and including version 1.3.2. According to the provided content, the flaw is caused by insufficient validation of user-supplied input in one or more plugin endpoints, allowing crafted requests to manipulate backend SQL queries. The content further states that this SQL injection condition can cascade into insecure deserialization, resulting in PHP Object Injection when attacker-controlled data is later processed unsafely. In environments where a suitable gadget chain exists, this secondary condition may enable remote code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Unknown
A SQL injection vulnerability referred to as WordPress CFDB7 SQLi affecting the WordPress CFDB7 plugin.
A critical pre-authentication SQL injection vulnerability in the WordPress Contact Form CFDB7 plugin that can cascade into insecure deserialization / PHP Object Injection, allowing remote exploitation without authentication.
A pre-authentication SQL injection vulnerability in the WordPress Contact Form CFDB7 plugin that can allow database manipulation and may potentially escalate to PHP object injection and remote code execution in certain environments.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.