WPSyncSheets For Contact Form 7: PHP Object Injection and Remote Code Execution (CVE-2026-104010)
The WPSyncSheets For Contact Form 7 WordPress plugin is vulnerable to unauthenticated remote code execution via insufficient sanitization of form submission fields and insecure deserialization.
CVE search metadata
CVE search record: CVE-2026-104010. Severity: high. CVSS: 7.5. KEV: no. Product: WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database (<= 1.8.0). Brief: WPSyncSheets For Contact Form 7: PHP Object Injection and Remote Code Execution (CVE-2026-104010). Brief link: https://feed.craftedsignal.io/briefs/2026-11-wpsyncsheets-rce/
Triage facts
Revision 1- Applicability
- WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database (<= 1.8.0)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 6, 13:11 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The WPSyncSheets For Contact Form 7 - CF7 Google Sheets Connector & Save to Database plugin for WordPress (versions up to and including 1.8.0) is vulnerable to Remote Code Execution via non-system CF7 field parameters. The vulnerability stems from insufficient sanitization of submission values before database storage and the lack of an allowed_classes restriction on maybe_unserialize() during admin retrieval. While PHP Object Injection occurs regardless, successful remote code execution requires a configured Google Sheets access token, which triggers the autoloading of the Monolog 2.10.0 library used as an exploit gadget chain.