CVE-2026-12081 Deserialization in Database for Contact Form 7, WPforms, Elementor forms
Unauthenticated attackers can inject PHP objects via form fields, leading to code execution when administrators view entries in this WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-12081?
CVE-2026-12081 is a medium-severity unsafe deserialization vulnerability in Unknown Database for Contact Form 7, WPforms, Elementor forms, published on 13 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.
Which versions are affected by CVE-2026-12081?
How do I fix CVE-2026-12081?
No fix has been published for CVE-2026-12081 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-12081 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-12081 exists.
Sources
Also known as GHSA-qq2h-g46x-whfp.