The Integration for Pipedrive and Contact Form 7 plugin contains an unchecked PHP Object Injection flaw within the verify_field_val() function. Unsanitized data is deserialized, enabling an attacker to inject arbitrary PHP objects. When coupled with a known post‑order‑pipe (POP) chain in the Contact Form 7 plugin, the attacker can delete arbitrary files, including wordpress configuration files, which can then trigger denial of service or execute arbitrary code on the host. The flaw is classified as CWE‑502, insecure deserialization.

The vulnerability affects the Integration for Pipedrive and Contact Form 7, WPForms, Elementor, and Ninja Forms plugin for WordPress, versions up to and including 1.2.3. Vendors include crmperks. No other product versions are reported as impacted.

The CVSS score of 9.8 indicates a critical threat, while the EPSS score of 2% signifies a moderate likelihood of exploitation. Because the flaw is unauthenticated and reachable via normal form submissions, an attacker only needs HTTP access to the vulnerable site and does not require specific privileges. The vulnerability is not yet listed in the CISA KEV catalog, but its severity and active exploitation channels imply that it could be leveraged in a broader campaign.