CVE-2025-7697 is a critical PHP Object Injection vulnerability affecting the "Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms" WordPress plugin, impacting all versions up to and including 1.1.1. This unauthenticated vulnerability, stemming from untrusted input deserialization in the verify_field_val() function, allows attackers to inject PHP Objects. Its severity is rated 9.8 CRITICAL, with a low attack complexity and no user interaction required, potentially leading to arbitrary file deletion (including wp-config.php for denial of service) or remote code execution when combined with a POP chain in the Contact Form 7 plugin. While not yet in the KEV catalog or having public exploit intelligence like Metasploit or Nuclei, it has garnered some community discussion, indicating awareness of its critical nature.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Crmperks | Integration For Google Sheets And Contact Form 7, WPForms, Elementor, Ninja Forms | >= 0, <= 1.1.1CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.