The vulnerability allows unauthenticated attackers to inject serialized PHP objects through the download_csv endpoint of the Database for Contact Form 7, WPforms, Elementor forms plugin. The injection itself does not contain a vulnerable object, so a successful exploit depends on the presence of a remote object property (POP) chain in the system. If such a chain exists, an attacker may delete files, exfiltrate data, or execute arbitrary code, resulting in a compromise of confidentiality, integrity, and availability of the affected site.

WordPress sites using the crmperks "Database for Contact Form 7, WPforms, Elementor forms" plugin in versions 1.4.7 or earlier are affected. No explicit sub-version details are provided beyond the maximum vulnerable version 1.4.7.

The CVSS score of 9.8 categorizes this as a critical vulnerability. The EPSS score indicates a very low probability of exploitation (<1%), and it is not listed in the CISA KEV catalog. The likely attack vector is a direct, unauthenticated HTTP request to the download_csv function, where a crafted payload would cause object deserialization. Success requires a pre‑existing POP chain, such as another plugin or theme that contains a vulnerable class. Without that additional component the vulnerability is effectively mitigated, but the potential for catastrophic impact remains if a POP chain is present.