Vulnerability · Published Jul 13, 2026 · Assigned by WPScan

CVE-2026-12081Database for Contact Form 7, WPforms, Elementor forms < 1.5.2 - Unauthenticated PHP Object Injection via Entry File Field

Medium 5.0

In plain English

A medium-severity security flaw in Database for Contact Form 7, WPforms, Elementor forms from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.2%top 86.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Database for Contact Form 7, WPforms, Elementor forms	0 – before 1.5.2

References

https://wpscan.com/vulnerability/91d0baf4-1052-4666-a28b-34689e06cbab/ exploit, vdb-entry, technical-description