CVE-2026-2599

CVE-2026-2599 is a PHP Object Injection vulnerability (CWE-502) in the Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress, affecting all versions up to and including 1.4.7. The issue arises from deserialization of untrusted input in the 'download_csv' function, enabling attackers to inject a PHP Object. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity due to network accessibility and lack of prerequisites.

Unauthenticated attackers can exploit this vulnerability remotely by supplying malicious input to the deserialization process. Although no known Property-Oriented Programming (POP) chain exists within the vulnerable plugin, the injection has no practical impact unless a compatible POP chain is provided by another plugin or theme on the target site. In such cases, exploitation could lead to severe consequences, including deletion of arbitrary files, retrieval of sensitive data, or arbitrary code execution, depending on the specific POP chain available.

Advisories and plugin repository references highlight mitigation through patching. The Wordfence threat intelligence page provides detailed analysis (vulnerability ID 7a116f28-a560-4b54-9cd1-f1dd9ac3238d), while Trac repository changesets, including 3474882, address the issue in the 'contact-form-entries.php' file around lines 2972 and 3016. Security practitioners should urge site owners to update the plugin immediately and audit for co-installed plugins or themes that might supply exploitable POP chains.