The Integration for Google Sheets and Contact Form 7 plugin is vulnerable to PHP Object Injection via the verify_field_val() function when deserializing untrusted input. Attackers can inject a PHP object, which, together with a deserialization chain in the Contact Form 7 plugin, can delete arbitrary files such as wp-config.php. This results in remote code execution or a denial of service. The flaw is identified as CWE‑502 and carries a CVSS score of 9.8.

Affected systems are WordPress sites running the Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin version 1.1.1 or earlier. The vulnerability exists in the plugin’s code that handles form submissions and depends on the commonly paired Contact Form 7 plugin.

With an EPSS score of 3 percent and the vulnerability not listed in CISA’s KEV catalog, it remains a high‑risk flaw but exploitation is unlikely to be widespread. The attack vector is unauthenticated and relies on the public form submission endpoint. An attacker requires no credentials but must send a crafted form submission containing a malicious serialized payload. Once executed, the payload may delete wp-config.php, leading to remote code execution or site downtime.