The Integration for Google Sheets and Contact Form 7 plugin is subject to PHP Object Injection via the verify_field_val() function when deserializing untrusted input. Attackers can inject a PHP object, which, together with a deserialization chain existing in Contact Form 7, can delete arbitrary files such as wp-config.php. This results in remote code execution or a denial of service. The flaw is identified as CWE‑502 and carries a CVSS score of 9.8.

Affected systems are WordPress sites running the Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin version 1.1.1 or earlier. The vulnerability exists in the plugin’s code that handles form submissions and in the dependent Contact Form 7 plugin which is commonly paired with it.

With an EPSS score of 2 percent and the vulnerability not yet listed in CISA’s KEV catalog, it remains a high‑risk flaw but exploitation is unlikely to be widespread. The attack vector is unauthenticated and relies on the public form submission endpoint. An attacker requires no credentials but must send a crafted form submission containing a malicious serialized payload. Once executed, the payload may delete wp-config.php, leading to remote code execution or site downtime.