WPSyncSheets For Contact Form 7 <= 1.8.0 - Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission…
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 21/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
The WPSyncSheets For Contact Form 7 WordPress plugin contains a flaw that lets an unauthenticated attacker run code on the server through a crafted Contact Form 7 submission, which requires a user action to trigger. It is reached remotely over the network without logging in, and exploiting the full code-execution path depends on a Google Sheets access token being configured in the plugin.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field (e.g., your-message)' parameter parameter. This is due to insufficient sanitization of CF7 submission field values before database storage and the absence of an allowed_classes restriction on maybe_unserialize() during admin retrieval. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation of the remote code execution gadget chain requires that a Google Sheets access token be configured in the plugin (its primary advertised feature), as this triggers autoloading of the bundled Monolog 2.10.0 library whose classes form the exploitable gadget chain; however, the underlying PHP Object Injection occurs regardless.
cve.now Index
- Exploitation0/40No signal
- Exposure7/25Reachable over the network without a login · Unknown: No advisory context yet
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.5/10CVSS 7.5, total technical impact per CISA
- No patch5/5No patch listed yet
What would change the score
- Would score about 76 if added to CISA KEV
- Would score about 71 if CISA's SSVC rates exploitation active
- Would score about 36 if advisories confirm default setups are exposed
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- creativewerkdesigns WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database
through 1.8.0
Evidence 7
- Link
- Link
- Link
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-104010
Is CVE-2026-104010 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
Which versions are affected by CVE-2026-104010?
WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database: through 1.8.0.Source: cve.now feed data