This vulnerability stems from the plugin’s failure to limit the PHP classes that can be instantiated during the unserialization of an attacker‑supplied form‑field value. An unauthenticated user can submit a crafted payload that creates arbitrary PHP objects; those objects are instantiated, potentially triggering any code they contain. The weakness is an instance of insecure deserialization (CWE‑502) and directly threatens confidentiality, integrity, and availability by allowing arbitrary code execution on the host server.

WordPress sites that have the Database for Contact Form 7, WPForms, or Elementor Forms plugin installed with a version earlier than 1.5.2 are affected. No specific vendor details are available beyond the plugin names. The issue resides in the entry‑editor file‑field functionality present in all three plugins before the stated threshold.

The CVSS score of 5 indicates medium severity, while the EPSS score of < 1% suggests a very low likelihood of exploitation at present. Nevertheless, the vulnerability was an incomplete fix of earlier, exploited CVEs (CVE‑2025‑7384 and CVE‑2026‑2599), implying that similar exploitation paths may still exist. Because the attack vector requires only unauthenticated form submission followed by an administrator viewing the stored entry, a successful attack does not depend on privileged access to the application code, making the risk high for affected sites that have not applied the fix.