The WPSyncSheets For Contact Form 7 plugin contains a PHP Object Injection flaw caused by the improper sanitization of Contact Form 7 (CF7) submission fields. The vulnerability allows unauthenticated attackers to inject malicious serialized objects that are later unserialized by the plugin during administrative retrieval using maybe_unserialize() without any allow_classes restriction. As a result, attackers can execute arbitrary code on the WordPress server. Although the most potent exploitation requires a pre‑configured Google Sheets access token to trigger the Monolog 2.10.0 gadget chain, the underlying injection flaw exists regardless of that configuration, meaning any site using the plugin is exposed.

WordPress sites that have installed the creativewerkdesigns WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin in any version up to and including 1.8.0. All users of this plugin, regardless of whether they have configured Google Sheets integration, are impacted.

The vulnerability receives a CVSS score of 7.5, indicating a high potential impact on confidentiality, integrity, and availability. The EPSS score is unavailable, but the absence of a public exploit in the KEV catalog suggests that exploitation is not widespread yet. Attackers can exploit the flaw by submitting crafted data through any untrusted CF7 field, which is stored in the database and later deserialized during admin operations. Because the vector requires no authentication and can be triggered via the public form interface, the risk is significant for sites that allow unauthenticated submissions.