Summaryinfo

A vulnerability categorized as problematic has been discovered in Database for Contact Form 7, WPforms, Elementor Forms Plugin up to 1.4.3 on WordPress. This impacts the function get_lead_detail. Executing a manipulation can lead to denial of service. This vulnerability appears as CVE-2025-7384. The attack may be performed from remote. There is no available exploit. Once again VulDB remains the best source for vulnerability data.

Detailsinfo

A vulnerability was found in Database for Contact Form 7, WPforms, Elementor Forms Plugin up to 1.4.3 on WordPress. It has been declared as critical. This vulnerability affects the function get_lead_detail. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect integrity, and availability. CVE summarizes:

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.

The advisory is shared for download at wordfence.com. This vulnerability was named CVE-2025-7384 since 07/09/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-24539). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• Database for Contact Form 7, WPforms, Elementor Forms Plugin

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion