WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injectio

The SQL injection vulnerability in Contact Form CFDB7 allows attackers to inject malicious SQL queries into the plugin's backend. This can be exploited to bypass authentication, retrieve sensitive data (user credentials, contact information, form submissions), modify database records, or even execute arbitrary commands on the server. The cascading insecure deserialization further amplifies the impact, enabling attackers to inject arbitrary PHP objects, potentially leading to remote code execution. Given the widespread use of WordPress and contact form plugins, a successful exploitation of this vulnerability could have a significant impact on numerous websites and their users.

Websites using the Contact Form CFDB7 plugin, particularly those running older, unpatched versions (0.0.0–1.3.2), are at significant risk. Shared hosting environments where multiple websites share the same server infrastructure are also at increased risk, as a compromise of one website could potentially lead to the compromise of others.

• wordpress / plugin: Use wp-cli to check the installed plugin version:

wp plugin list --status=active | grep Contact Form CFDB7

• wordpress / plugin: Search plugin files for vulnerable code patterns (e.g., $GET, $POST without proper sanitization) using grep. • generic web: Monitor access logs for unusual SQL query patterns targeting the plugin's endpoints. Look for UNION SELECT or other common SQL injection techniques. • generic web: Check response headers for unexpected PHP object serialization or deserialization activity.

1. 2025-10-28Disclosure

   disclosure

1. Reserviert2025-05-13
2. Veröffentlicht2025-10-28
3. Geändert2025-10-29
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-4665 is to immediately upgrade the Contact Form CFDB7 plugin to version 1.3.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin. As a short-term workaround, implement a Web Application Firewall (WAF) with rules to filter out potentially malicious SQL injection attempts targeting the plugin's endpoints. Regularly review and sanitize all user inputs within the plugin to prevent future vulnerabilities. Monitor WordPress logs for suspicious SQL queries or PHP object creation activity.

Aktive Installationen

600KNische

Plugin-Bewertung