Security Advisory

CVE-2025-8145

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-08-20 01:44:35

Last updated 2026-04-08 16:43:57

Assigner Wordfence

State PUBLISHED

Description

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the get_lead_fields function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in a Contact Form 7 plugin allows attackers to delete arbitrary files. Additionally, in certain server configurations, Remote Code Execution is possible

← Browse all CVEs View on cve.org ↗