Loading vulnerability…
CVE-2025-7384 is an unauthenticated PHP Object Injection vulnerability in the WordPress plugin Database for Contact Form 7, WPforms, Elementor forms affecting versions up to and including 1.4.3. The flaw is caused by deserialization of untrusted input in the get_lead_detail function, allowing attacker-controlled data to be unserialized into PHP objects. In environments where a usable property-oriented programming chain is present, particularly when Contact Form 7 is also installed, the vulnerability can be leveraged beyond object injection to perform arbitrary file deletion. Deletion of critical WordPress files can in turn lead to denial of service and may enable remote code execution or full site compromise through forced reinstallation and reconfiguration flows.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a working Python proof-of-concept plus a Dockerized WordPress lab to reproduce CVE-2025-7384, an unauthenticated PHP object injection in the WordPress plugin 'Database for Contact Form 7' (contact-form-entries) <= 1.4.3. The exploit logic in poc.py performs reconnaissance by checking plugin readme files, searches common site paths for a Contact Form 7 form, and submits a serialized PHP object payload through the form without authentication. The intended trigger occurs later when an administrator views the stored entry, causing the vulnerable plugin's verify_val() path to call maybe_unserialize() on attacker-controlled data. The included payloads are POP-chain style serialized objects: a lab-specific VulnerableFileHandler gadget and an alternative WP_HTML_Token gadget reference for older WordPress versions. The default effect is deletion of /var/www/html/wp-config.php, which the script then uses as a pivot toward WordPress reinstall, admin takeover, plugin upload, and eventual webshell/RCE when --full-chain is used. Repository structure: README.md and CVE-2025-7384_Report_EN.md provide detailed vulnerability write-up and exploitation chain; poc.py is the main exploit; docker-compose.yml provisions MySQL and WordPress on localhost:8181; setup.sh automates lab installation, installs Contact Form 7 and vulnerable contact-form-entries 1.4.3, creates a contact page, enables debugging, and drops a mu-plugin gadget class to make exploitation deterministic. Overall, this is a real exploit repository with both exploitation code and a reproducible lab environment, not merely a detector.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A PHP object injection vulnerability in Database for CF7. The content indicates detection was converted to version-only because exploitation cannot be reliably verified remotely.
A PHP object injection vulnerability in the WordPress Database for Contact Form 7 plugin.
An unauthenticated PHP Object Injection (unsafe deserialization) vulnerability in a WordPress plugin (“Database for Contact Form 7, WPforms, Elementor forms”), affecting versions <= 1.4.3, with critical severity (CVSS 9.8).
A PHP Object Injection vulnerability caused by unsafe deserialization in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin, enabling unauthenticated remote attackers to delete arbitrary files and potentially take over a site.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.