CVE-2026-12081
Medium
Description
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.
SeverityMedium
CVSS5.0
Exploit probability—
ProductDatabase for Contact Form 7, WPforms, Elementor forms
PublishedJul 13, 2026
First seenJul 13, 2026
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- Database for Contact Form 7, WPforms, Elementor forms1.5.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Database for Contact Form 7, WPforms, Elementor forms | v < 1.5.2 | 1.5.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.