CVE-2025-7384

CRITICAL

Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-7384 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 lab environment.

Description

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 13, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Database for Contact Form 7, WPforms, Elementor forms

Browse crmperks / Database for Contact Form 7, WPforms, Elementor forms

Default status: unaffected

CVE ListThrough 1.4.3affected

Proofs of concept

1

Repository PoCs

GitHubDungsocool/CVE-2025-7384Repository PoCby Dungsocool0Writeup19 files

1.6 MiB

GitHub
PoC details
AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

A detailed technical writeup analyzing CVE-2025-7384, a PHP Object Injection vulnerability in the 'Database for Contact Form 7' WordPress plugin. The document provides root cause analysis, attack chain description, and step-by-step reproduction instructions, but does not contain executable exploit or scanner code.

Backdoor review

Suspicious behavior

The PoC documentation describes a legitimate PHP Object Injection exploit against the stated target plugin. However, the final RCE stage instructs the operator to upload a webshell from a supplied ZIP file (`payload withheld` or `system-monitor.zip`). This ZIP is present in the repository as an uninspected binary, and its behavior is not disclosed in the readable text. The operator is directed to install and activate this opaque plugin on a compromised host, which creates a material concern about concealed, operator-directed harmful behavior.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
Languagesmarkdownphpbash
Target softwareWordPressDatabase for Contact Form 7 plugin (contact-form-entries)
Attack typesPHP Object InjectionRemote Code ExecutionArbitrary File Deletion
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a technical report (writeup) that explains the vulnerability, its root cause, and a reproduction process. It does not provide any standalone executable code to exploit or scan for the vulnerability; the described steps require manual interaction and external tools (Docker, a webshell ZIP). The content is purely analytical and instructional.

CVE-2025-7384_Report_EN.md:1-394

Requirements

  • Target must run WordPress with the vulnerable 'contact-form-entries' plugin (≤ 1.4.3) and Contact Form 7.CVE-2025-7384_Report_EN.md:3
  • A POP chain (e.g., a class with a __destruct() method calling unlink()) must be available in the environment.CVE-2025-7384_Report_EN.md:29

Observed behavior

  • Describes how an unauthenticated attacker can inject a serialized PHP object via a Contact Form 7 form field.CVE-2025-7384_Report_EN.md:199-203
  • Explains that the payload is stored in the database and deserialized via maybe_unserialize() when an admin views the entry.CVE-2025-7384_Report_EN.md:86-96
  • Outlines a multi-stage attack chain culminating in arbitrary file deletion and remote code execution via WordPress reinstallation.CVE-2025-7384_Report_EN.md:193-232
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Concealed Executable Behavior
  • The PoC instructs the operator to upload and activate a webshell plugin from a supplied ZIP file (`payload withheld` or `system-monitor.zip`). The ZIP is flagged as an uninspected binary, and its internal code is not disclosed in the reviewed text. The operator is directed to execute this opaque payload on a target system without any inspection of its behavior.CVE-2025-7384_Report_EN.md:312-316

Observables

Binary Artifact
Payload withheldSupplied ZIP file intended to be uploaded as a WordPress plugin webshell. Its contents are uninspected, and the PoC text does not reveal its internal code.CVE-2025-7384_Report_EN.md:312
Review boundaries

What the analysis did not establish

  • The artifact contains references to binary files (e.g., payload withheld) and images that were not analyzed, but the text content is complete.
  • The analysis is based solely on the supplied text; no code was executed to verify the described behavior.
  • The `payload withheld` binary is uninspected; its internal code and any hidden behavior are not reviewed.
  • Only two text files from the repository were provided; other files, including potential plugin source code, were omitted.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Dungsocool/CVE-2025-7384Created Vuln labCVE-2025-7384Compose · mixed

1 Compose manifest · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for a CVE-2025-7384 vulnerability lab, consisting of a MySQL 5.7 database and a WordPress service with a vulnerable contact-form-entries plugin. The lab demonstrates unauthenticated PHP object injection leading to remote code execution.

docker-compose.yml:1-42README.md:1-394

Lab assessment

Vulnerability lab

The README explicitly describes a vulnerability (CVE-2025-7384), its root cause, and a step-by-step reproduction. The Docker Compose file sets up a WordPress instance with a vulnerable plugin, and setup.sh installs the vulnerable plugin and a lab POP gadget. The poc.py script automates the exploit chain. All components are directed at demonstrating the vulnerability.

README.md:1-10docker-compose.yml:1-42setup.sh:1-159poc.py:1-440
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

databaseMySQL 5.7

MySQL 5.7 database service for WordPress. Stores form entries including the serialized payload.

docker-compose.yml:4-14

wordpress

web applicationvulnerable target

WordPress service built from a Dockerfile (not provided). Runs the vulnerable contact-form-entries plugin and a lab POP gadget. Exposes port 8181 for HTTP access. Mounts ./wp-src for source code debugging.

docker-compose.yml:16-35setup.sh:1-159

setup.sh

lab initializervulnerability enabler

Bash script that installs WordPress, the vulnerable contact-form-entries plugin (version 1.4.3), Contact Form 7, creates a contact page, and installs a lab POP chain gadget (VulnerableFileHandler) as a mu-plugin. Also makes wp-config.php writable for the exploit.

setup.sh:1-159

poc.py

exploit scriptautomation

Python script that automates the full attack chain: injects a serialized PHP object via the CF7 form, triggers deserialization by simulating admin login, verifies wp-config.php deletion, reinstalls WordPress with attacker credentials, and uploads a webshell for RCE.

poc.py:1-440

VulnerableFileHandler (lab gadget)

POP chain gadgetlab-only

A PHP class installed as a mu-plugin by setup.sh. Its __destruct() method deletes a file specified in the $file_path property when $cleanup is true. Used to demonstrate the impact of the deserialization vulnerability.

setup.sh:120-137
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-7384

Supported by supplied evidence

The README, poc.py, and setup.sh all explicitly reference CVE-2025-7384 and describe a PHP object injection vulnerability in contact-form-entries ≤ 1.4.3. The lab installs the vulnerable version and provides a complete exploit chain matching the CVE description.

README.md:1-10poc.py:1-10setup.sh:1-159
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.README.md:1
  • The lab must be started with 'docker-compose up --build -d' and wait for 'LAB READY' message.README.md:1
  • The target WordPress site must have Contact Form 7 and the vulnerable contact-form-entries plugin active.poc.py:1
  • An admin must view the injected form entry to trigger deserialization (simulated by poc.py).README.md:1

Evidence-described exercise path

  1. Start the Docker lab: docker-compose up --build -dREADME.md:1
  2. Inject a serialized PHP object payload into the 'your-message' field of the CF7 form on /contact/.README.md:1
  3. Log in as admin (admin/admin123) and view the CRM Entries to trigger deserialization, which deletes wp-config.php.README.md:1
  4. Verify wp-config.php deletion by accessing the site and seeing the WordPress installation wizard.README.md:1
  5. Reinstall WordPress with attacker-controlled admin credentials.README.md:1
  6. Upload a webshell plugin and execute commands to achieve RCE.README.md:1
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior targets the lab's own WordPress container. The exploit deletes wp-config.php within the container, reinstalls WordPress, and uploads a webshell—all actions confined to the lab environment. No evidence of host escape, external connections, persistence outside the lab, credential theft, or destructive behavior beyond the intended demonstration.

poc.py:1-440setup.sh:1-159docker-compose.yml:1-42
Review boundaries

What the analysis did not establish

  • The Dockerfile referenced in docker-compose.yml (build: .) is not included in the evidence packet, so the WordPress image contents cannot be fully verified.
  • The wp-src directory mounted into the container is not provided, so the exact source code of the vulnerable plugin cannot be confirmed from the packet alone.
  • The system-health.zip file is listed in the file inventory but its contents are not included as text; it is a binary ZIP file and was not inspected.
  • The lab uses a custom POP gadget (VulnerableFileHandler) that is not part of a real WordPress installation; the real-world exploitability depends on available gadgets in the target environment.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

4