Database for Contact Form 7, WPforms, Elementor forms < 1.5.2 – Unauthenticated PHP Object Injection via Entry File Field | CVE 2026-12081

Description

The plugin does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.

Proof of Concept

Actor for the injection: an unauthenticated visitor. Precondition: a published contact form that includes a file-upload field (a standard configuration; the example uses Contact Form 7, the plugin's primary integration, with a form containing `[file your-file]`).

1. As an unauthenticated visitor, submit the contact form, sending the file field `your-file` as a normal text parameter set to a serialized PHP object. No actual file is attached. Replace the form id `5` with the target form id:

```bash
curl -s 'https://victim.example/index.php?rest_route=/contact-form-7/v1/contact-forms/5/feedback' \
  -F '_wpcf7=5' -F '_wpcf7_version=6.1.6' -F '_wpcf7_unit_tag=wpcf7-f5-o1' \
  -F 'your-name=Attacker' \
  -F 'your-file=O:8:"VX_Probe":0:{}'
```

The plugin stores the value verbatim. Confirmed stored row (the lead is recorded with `user_id=0`, i.e. unauthenticated):

```
wp_vxcf_leads_detail:  lead_id=3 | name=your-file | value=O:8:"VX_Probe":0:{}
wp_vxcf_leads:         id=3 | form_id=cf_5 | user_id=0
```

2. When an administrator opens that entry in the plugin's CRM Entries screen (`/wp-admin/admin.php?page=vxcf_leads&tab=entries&id=3`) and clicks Save, the editor handler reaches `maybe_unserialize($detail['your-file']['value'])` and instantiates the object. To prove deserialization with a sentinel class (representing a gadget supplied by a companion plugin/theme), a class such as the following demonstrates execution; with the payload above it instantiates and runs `__wakeup`:

```php
class VX_Probe { public function __wakeup(){ update_option('vx_pop_marker','FIRED'); } }
```

Observed result: before the administrator's save, the option `vx_pop_marker` does not exist; immediately after the save the option equals `FIRED`, proving the attacker-planted serialized object was deserialized and instantiated. Substituting a real POP chain from an installed plugin/theme in place of the sentinel class turns this into the corresponding primitive (for example arbitrary file deletion).