The extension for Contact Form 7, WPforms, and Elementor forms processes user supplied data in its get_lead_detail routine without sanitizing it. An attacker who is not logged in can craft a serialized payload that, when deserialized, injects a PHP Object into the application. This injection can activate a POP chain inside the vulnerable code, which in turn allows the attacker to delete any file on the server. Removing critical files such as wp-config.php can cripple the WordPress site or, in certain configurations, enable execution of arbitrary code. The weakness is categorized as CWE‑502, Untrusted Deserialization.

WordPress installations using the crmperks Database for Contact Form 7, WPforms, Elementor forms plugin with any version up to and including 1.4.3 are affected. This includes the three form plugins that rely on the same database module: Contact Form 7, WPforms, and Elementor forms.

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of 2% points to a moderate likelihood of exploitation. The vulnerability is not yet listed in the CISA KEV catalog, yet the combination of unauthenticated access and the capability to delete arbitrary files makes it a high‑risk flaw. Based on the description, it is inferred that the attacker can reach the vulnerable get_lead_detail endpoint via normal web traffic without authentication, craft a malicious serialized payload, trigger the PHP Object Injection, and then remove critical files, potentially causing denial of service or remote code execution.