FKIE_CVE-2025-4665

Vulnerability from fkie_nvd - Published: 2025-10-29 00:15 - Updated: 2026-10-08 11:10
Severity
9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Summary
WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injection). The weakness arises due to insufficient validation of user input in plugin endpoints, allowing crafted input to influence backend queries in unexpected ways. Using specially crafted payloads, this can escalate into unsafe deserialization, enabling arbitrary object injection in PHP. Although the issue is remotely exploitable without authentication, it does require a crafted interaction with the affected endpoint in order to trigger successfully.
References
mandiant-cve@google.comhttps://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0006.md
mandiant-cve@google.comhttps://wordpress.org/plugins/contact-form-cfdb7
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://wordpress.org/plugins/contact-form-cfdb7/",
          "defaultStatus": "unaffected",
          "product": "CFDB7",
          "vendor": "WordPress Contact Form 7 Database Addon CFDB7 By Arshid",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.3.3",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.3.2",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "mandiant-cve@google.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injection). The weakness arises due to insufficient validation of user input in plugin endpoints, allowing crafted input to influence backend queries in unexpected ways. Using specially crafted payloads, this can escalate into unsafe deserialization, enabling arbitrary object injection in PHP. Although the issue is remotely exploitable without authentication, it does require a crafted interaction with the affected endpoint in order to trigger successfully."
    },
    {
      "lang": "es",
      "value": "El plugin de WordPress Contact Form CFDB7 versiones hasta la 1.3.2 inclusive se ven afectadas por una vulnerabilidad de inyecci\u00f3n SQL de pre-autenticaci\u00f3n que se propaga a la deserializaci\u00f3n insegura (Inyecci\u00f3n de Objetos PHP). La debilidad surge debido a la validaci\u00f3n insuficiente de la entrada del usuario en los puntos finales del plugin, permitiendo que una entrada manipulada influya en las consultas de backend de formas inesperadas. Usando cargas \u00fatiles especialmente dise\u00f1adas, esto puede escalar a la deserializaci\u00f3n insegura, permitiendo la inyecci\u00f3n arbitraria de objetos en PHP. Aunque el problema es explotable remotamente sin autenticaci\u00f3n, s\u00ed requiere una interacci\u00f3n manipulada con el punto final afectado para activarse con \u00e9xito."
    }
  ],
  "id": "CVE-2025-4665",
  "lastModified": "2026-10-08T11:10:00.250",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0,
        "source": "mandiant-cve@google.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-4665",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-10-29T14:48:03.383396Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-10-29T00:15:34.970",
  "references": [
    {
      "source": "mandiant-cve@google.com",
      "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0006.md"
    },
    {
      "source": "mandiant-cve@google.com",
      "url": "https://wordpress.org/plugins/contact-form-cfdb7"
    }
  ],
  "sourceIdentifier": "mandiant-cve@google.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "mandiant-cve@google.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.