{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins/contact-form-cfdb7/","defaultStatus":"unaffected","product":"CFDB7","vendor":"WordPress Contact Form 7 Database Addon CFDB7 By Arshid","versions":[{"changes":[{"at":"1.3.3","status":"unaffected"}],"lessThanOrEqual":"1.3.2","status":"affected","version":"0.0.0","versionType":"custom"}]}],"source":"mandiant-cve@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injection). The weakness arises due to insufficient validation of user input in plugin endpoints, allowing crafted input to influence backend queries in unexpected ways. Using specially crafted payloads, this can escalate into unsafe deserialization, enabling arbitrary object injection in PHP. Although the issue is remotely exploitable without authentication, it does require a crafted interaction with the affected endpoint in order to trigger successfully."},{"lang":"es","value":"El plugin de WordPress Contact Form CFDB7 versiones hasta la 1.3.2 inclusive se ven afectadas por una vulnerabilidad de inyección SQL de pre-autenticación que se propaga a la deserialización insegura (Inyección de Objetos PHP). La debilidad surge debido a la validación insuficiente de la entrada del usuario en los puntos finales del plugin, permitiendo que una entrada manipulada influya en las consultas de backend de formas inesperadas. Usando cargas útiles especialmente diseñadas, esto puede escalar a la deserialización insegura, permitiendo la inyección arbitraria de objetos en PHP. Aunque el problema es explotable remotamente sin autenticación, sí requiere una interacción manipulada con el punto final afectado para activarse con éxito."}],"id":"CVE-2025-4665","lastModified":"2026-10-08T11:10:00.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"mandiant-cve@google.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-4665","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-10-29T14:48:03.383396Z","version":"2.0.3"}}]},"published":"2025-10-29T00:15:34.970","references":[{"source":"mandiant-cve@google.com","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0006.md"},{"source":"mandiant-cve@google.com","url":"https://wordpress.org/plugins/contact-form-cfdb7"}],"sourceIdentifier":"mandiant-cve@google.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"mandiant-cve@google.com","type":"Secondary"}]}