Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-12081 The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-suppl… https://www.cve.org/CVERecord?id=CVE-2026-12081
Post summary
A newly disclosed WordPress plugin vulnerability (CVE-2026-12081) allows an attacker to manipulate PHP class deserialization, potentially enabling code execution.
🚨*CVE* CVE-2026-12081 The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-suppl… https://www.cve.org/CVERecord?id=CVE-2026-12081 ----- Traducción: CVE-2026-12081. La… http://infoflow.cloud`
Post summary
A new CVE (CVE‑2026‑12081) has been announced, affecting WordPress form plugins that allow unrestricted PHP class usage during unserialization, potentially enabling remote code execution.