CVE-2025-7384: Critical PHP Object Injection in WordPress Form Database Plugin

Overview

CVE-2025-7384 is a critical-severity PHP Object Injection vulnerability affecting the Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress. All versions up to and including 1.4.3 are vulnerable. With a CVSS score of 9.8, this vulnerability sits at the very top of the risk scale and demands immediate attention from any WordPress site operator running this plugin.

What Is the Vulnerability?

The flaw is rooted in CWE-502: Deserialization of Untrusted Data. Specifically, the plugin's get_lead_detail function deserializes user-supplied input without proper validation or sanitization, making it possible for an attacker to inject arbitrary PHP objects into the application's execution flow.

On its own, PHP Object Injection can be limited in impact — but the real danger here comes from a POP (Property-Oriented Programming) chain present in the widely-used Contact Form 7 plugin, which is commonly installed alongside this database plugin. When that POP chain is leveraged, attackers can:

• Delete arbitrary files on the server, causing a denial of service.
• Delete wp-config.php, which triggers WordPress to enter setup mode — effectively allowing an attacker to reconfigure the database and gain full administrative control, resulting in remote code execution (RCE).

Attack Surface

What makes this vulnerability particularly alarming is that it requires no authentication. An unauthenticated attacker on the public internet can send a crafted request to a vulnerable WordPress installation and trigger the deserialization gadget chain without any prior access, credentials, or user interaction needed. The combination of a zero-barrier entry point with a critical outcome — full site compromise or takedown — places this firmly in the highest-risk category.

Exploit and Threat Status

As of the publication date of August 13, 2025, this vulnerability already has a confirmed weaponized exploit available in the wild. A public proof-of-concept has been published on GitHub by researcher Dungsocool (github.com/Dungsocool/CVE-2025-7384), and the vulnerability also appears in Exploit-DB's index. The existence of a weaponized exploit dramatically shortens the window between disclosure and active abuse.

The EPSS score stands at 1.04%, placing this CVE in the 77th percentile of exploitation probability — meaning it is assessed as more likely to be exploited than approximately three-quarters of all published CVEs. No specific threat actor groups have been attributed to active exploitation in the available data at this time.

CVE-2025-7384 has not yet been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, though its weaponized exploit status and high EPSS percentile suggest that trajectory is plausible.

Patch Status

As of the data available, no patch has been released for this vulnerability. This is a critical gap. WordPress site administrators relying on this plugin are currently without an official fix from the vendor.

Remediation Guidance

Given the absence of a patch, organizations should take the following immediate steps:

• Deactivate and remove the Database for Contact Form 7, WPforms, Elementor forms plugin (versions ≤ 1.4.3) from all WordPress installations until a patched version is available.
• Audit server file integrity — particularly check whether wp-config.php and other critical files remain intact on any potentially exposed sites.
• Deploy a Web Application Firewall (WAF) with rules targeting PHP deserialization payloads to reduce exploitation risk while awaiting a vendor patch.
• Monitor plugin update channels closely and apply any released patch immediately upon availability.
• Review access and error logs for suspicious requests to form submission endpoints, which may indicate active exploitation attempts.

Stay Ahead of Emerging Threats

CVE-2025-7384 is a stark reminder that even utility plugins with broad WordPress ecosystems can carry critical, immediately exploitable risks. Track this CVE, monitor its patch status, and stay informed on emerging vulnerabilities by visiting sec.kaitan.id — your hub for timely, actionable vulnerability intelligence.