CVE-2026-12081

MediumCVSS 5.0/10Last modified Jul 13, 2026

Description

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Affected software

Vendor	Product	Versions
Unknown	Database for Contact Form 7, WPforms, Elementor forms	< 1.5.2

References

https://wpscan.com/vulnerability/91d0baf4-1052-4666-a28b-34689e06cbab/

Timeline

Published: Jul 13, 2026
Last modified: Jul 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1208106.5An issue in MongoDB server’s aggregation framework allows an authenticated user with read privileges to cause a denial of service by sending CVE-2026-1208115.9A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference CVE-2026-1208126.5An issue in MongoDB Server's query processing component allows an authenticated user with read privileges to cause a denial of service. Unco CVE-2026-1208135.9An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing component allows encryption metadata to be silentl CVE-2026-1208147.2An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrati CVE-2026-1208158.4An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to CVE-2026-1208164.3A user with basic read-tier database privileges can use an option on a server-side data-change notification feature to receive the contents CVE-2026-1208176.5A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection vali CVE-2026-1208187.1A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed CVE-2026-1208194.3A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only re CVE-2026-120827.5The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthent CVE-2026-1208204.3MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are c