CVE-2025-7697
Published: 19 July 2025
Summary
CVE-2025-7697 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions through 1.1.1. The flaw stems from unsafe deserialization of untrusted input inside the verify_field_val() function, which is tracked under CWE-502 and carries a CVSS 3.1 score of 9.8.
Unauthenticated attackers can supply a serialized payload to inject a PHP object. When the plugin is used alongside Contact Form 7, the presence of a property-oriented programming chain enables deletion of arbitrary files on the server, which can produce a denial-of-service condition or remote code execution once wp-config.php is removed.
The EPSS score has remained flat at 0.0326 with no material increase after disclosure. Public references point to the plugin’s source repository and a Wordfence advisory but contain no additional exploitation or mitigation details beyond the version cutoff.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21948
Vulnerability details
The Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.1 via deserialization of untrusted input within the verify_field_val() function. This…
more
makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote exploitation of a public-facing WordPress plugin via deserialization, enabling RCE/file deletion.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the PHP object injection flaw via plugin patching as specified in the CVE remediation changeset.
Mandates validation of untrusted inputs to block malicious deserialization in the verify_field_val() function exploited by unauthenticated attackers.
Enables scanning and monitoring to identify the critical PHP object injection vulnerability (CVSS 9.8) in the WordPress plugin for prompt remediation.