CVE-2026-104010 Details
Description
The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field (e.g., your-message)' parameter parameter. This is due to insufficient sanitization of CF7 submission field values before database storage and the absence of an allowed_classes restriction on maybe_unserialize() during admin retrieval. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation of the remote code execution gadget chain requires that a Google Sheets access token be configured in the plugin (its primary advertised feature), as this triggers autoloading of the bundled Monolog 2.10.0 library whose classes form the exploitable gadget chain; however, the underlying PHP Object Injection occurs regardless.
A remote code execution vulnerability exists in the WPSyncSheets for Contact Form 7 plugin for WordPress, in all versions through 1.8.0. The vulnerability arises from inadequate sanitization of Contact Form 7 submission field values before they are stored in the database. Additionally, during admin retrieval, the 'maybe_unserialize()' function lacks an 'allowed_classes' restriction, allowing for PHP object injection. This exploitation can be triggered through any non-system CF7 field parameter. Although the vulnerability allows for unauthenticated code execution on the server, successful exploitation requires a Google Sheets access token to be configured in the plugin, which activates the autoloading of the Monolog 2.10.0 library. This library's classes can be exploited to execute arbitrary code, while the PHP object injection vulnerability can be exploited independently.
Users are advised to update the WPSyncSheets for Contact Form 7 plugin to version 1.8.1 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WPSyncSheets | <= 1.8.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 6, 2026 | New CVE Received | [email protected] |