LiveActive security incident?Get immediate response
CVE Record

CVE-2026-2599: Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv'

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'download_csv' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A WordPress form database plugin has a critical deserialization flaw reachable by unauthenticated attackers in versions up to 1.4.7. By itself, the plugin reportedly has no known usable attack chain, but other installed plugins or themes could make the impact severe, including data theft, file deletion, or code execution.

Executive priority

Prioritize identification and remediation on internet-facing WordPress sites. Although exploitation impact is conditional, unauthenticated reachability and potential full site compromise justify urgent review, especially on business-critical sites or sites with many third-party plugins.

Technical view

CVE-2026-2599 is CWE-502 PHP Object Injection in the Database for Contact Form 7, WPforms, Elementor forms plugin. The vulnerable path is the download_csv function, which deserializes untrusted input. CVSS is 9.8. Impact depends on whether another installed component provides a POP chain; the vulnerable plugin itself has no known POP chain per the source description.

Likely exposure

Public WordPress sites using the crmperks Database for Contact Form 7, WPforms, Elementor forms plugin at version 1.4.7 or earlier. Risk is higher where many plugins or custom themes are installed, because a separate POP chain may enable serious impact.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The flaw is unauthenticated and network reachable, but practical impact is conditional on a usable POP chain from another plugin or theme on the same site.

Researcher notes

Focus analysis on the download_csv deserialization path and the referenced WordPress Trac lines and changeset. Do not assume remote code execution without identifying a POP chain in another installed component. Patch-version evidence is not fully explicit in the provided bundle beyond affected versions through 1.4.7.

Mitigation direction

  • Update the plugin beyond 1.4.7 if a fixed release is available from the vendor or WordPress repository.
  • If no fixed release is available, disable or remove the plugin until vendor guidance is available.
  • Keep other WordPress plugins and themes current to reduce POP-chain exposure.
  • Review vendor, Wordfence, and WordPress plugin repository guidance for confirmed remediation details.
  • Back up affected WordPress sites before making plugin changes.

Validation and detection

  • Inventory WordPress sites for the affected plugin and record installed versions.
  • Treat versions 1.4.7 and earlier as vulnerable based on the source description.
  • Check whether the WordPress repository change referenced by changeset 3474882 is present locally.
  • Review installed plugins and themes for known deserialization gadget or POP-chain advisories.
  • Monitor web logs for unusual CSV download or plugin-related unauthenticated requests.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-502: Code execution behavior lookup

Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-2599 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2026-2599Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
crmperksDatabase for Contact Form 7, WPforms, Elementor forms0unaffected
Weakness

CWE details

CWE-502

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-502 · source CWE mapping

Deserialization of Untrusted Data

Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs