Introduction
Attackers can compromise WordPress sites running Contact Form CFDB7 without credentials, which could lead to full site takeover. The plugin has over 600,000 installations, so this flaw could affect data integrity and site security on a large number of WordPress sites.
Contact Form CFDB7 is a widely used WordPress plugin that stores Contact Form 7 submissions in the database. That reach means a critical flaw in its code is a serious concern for site operators and service providers alike.
Technical Information
CVE-2025-4665 is a pre-authentication SQL injection vulnerability in Contact Form CFDB7 versions up to and including 1.3.2. The root cause is insufficient input validation in one or more plugin endpoints that process user-supplied data. An attacker can send crafted payloads to these endpoints and manipulate the backend SQL queries directly. Because the input is not properly sanitized and prepared statements are not used, the attacker can inject arbitrary SQL and use it to extract or modify database contents.
The vulnerability is especially severe because it can escalate into insecure deserialization (PHP object injection). If attacker-controlled input is stored in the database and later unserialized by the plugin or another WordPress component, the attacker can inject arbitrary objects. If suitable gadget chains are present in the environment, that can lead to remote code execution. No authentication is required, but the attacker must interact with a specific vulnerable endpoint. No vulnerable code snippets or proof-of-concept details are publicly available at this time.
Affected Systems and Versions
- Product: Contact Form CFDB7 (WordPress plugin)
- Affected Versions: Up to and including 1.3.2
- Only sites with this plugin enabled and not updated beyond 1.3.2 are vulnerable
Vendor Security History
Contact Form CFDB7 has a history of security issues, including:
- Previous SQL injection vulnerabilities (e.g., CVE-2021-01-21)
- CSV injection (CWE-1336) in version 1.2.5.5
- Unauthenticated stored XSS (CVE-2025-6740) in versions up to 1.3.1
The vendor has released patches for past vulnerabilities, but input validation flaws have recurred. Patch response times have varied, and details of the fix for CVE-2025-4665 are not yet public.
