{"id":"CVE-2026-104010","kind":"vulnerability","aliases":["CVE-2026-104010"],"related":[],"title":"WordPress WPSyncSheets plugin: unauthenticated form input leads to code execution","description":"The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field (e.g., your-message)' parameter parameter. This is due to insufficient sanitization of CF7 submission field values before database storage and the absence of an allowed_classes restriction on maybe_unserialize() during admin retrieval. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation of the remote code execution gadget chain requires that a Google Sheets access token be configured in the plugin (its primary advertised feature), as this triggers autoloading of the bundled Monolog 2.10.0 library whose classes form the exploitable gadget chain; however, the underlying PHP Object Injection occurs regardless.","summary":"The WPSyncSheets plugin for WordPress saves Contact Form 7 submission values to the database without sanitizing them, then unserializes them in admin retrieval without class restrictions. An unauthenticated attacker can submit crafted form data that triggers PHP object injection and, with a Google Sheets access token configured, code execution on the server.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"contactsheets-lite","fixed":["1.8.1"],"affected":"<= 1.8.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["contact-form-7","package","php","wordpress","wpsyncsheets"],"not_affected_if":["plugin-1.8.1-or-newer","plugin-newer-than-1.8.0","plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: find 'WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database' (slug contactsheets-lite); version 1.8.0 or lower is affected, 1.8.1 is patched.\n- WP-CLI: wp plugin get contactsheets-lite --field=version\n- A Google Sheets connection (access token) in the plugin settings makes the code-execution chain reachable via the bundled Monolog 2.10.0; without it the PHP object injection still occurs.\n- Look in the plugin's saved entries for submission values beginning with O: or a: (serialized PHP), and do not open such entries in the admin until updated.","fix":"Update WPSyncSheets For Contact Form 7 (slug contactsheets-lite) to 1.8.1 or newer (Wordfence: patched version 1.8.1).","status":"open","published_at":"2026-11-06T12:17:15+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","triaged_at":"2026-11-06T12:42:48+00:00","updated_at":"2026-11-06T12:43:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T12:42:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress WPSyncSheets plugin: unauthenticated form input leads to code execution","impact":"high","summary":"The WPSyncSheets plugin for WordPress saves Contact Form 7 submission values to the database without sanitizing them, then unserializes them in admin retrieval without class restrictions. An unauthenticated attacker can submit crafted form data that triggers PHP object injection and, with a Google Sheets access token configured, code execution on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","contact-form-7","wpsyncsheets","php"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker executes code on the WordPress server","analyst_note":"Confirm the fixed version from the plugin's product data on NVD or WordPress.org; the signal gives no fixed version.","how_to_check":"- Check whether the WPSyncSheets For Contact Form 7 plugin is installed and its version is `1.8.0` or lower in the WordPress admin plugin list\n- Check whether a Google Sheets access token is configured in the plugin settings, since it enables the full gadget chain\n- unknown for further detail from the sources","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-newer-than-1.8.0"],"who_is_affected":"Sites running the WPSyncSheets For Contact Form 7 plugin version 1.8.0 or earlier that accept Contact Form 7 submissions. The plugin's Google Sheets integration makes exploitation fully reachable, but the object injection occurs regardless of that configuration. Sites without this plugin installed are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000768,"input_tokens":4437,"output_tokens":648,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version from the plugin's product data on NVD or WordPress.org; the signal gives no fixed version.","search":"'-104010':13A,16A '-2026':12A,15A '1.8.0':109C '2.10.0':198C '7':23B,36B,85C 'absenc':140C 'access':72B,179C 'admin':49B,150C 'advertis':188C 'allow':143C 'attack':56B,158C 'autoload':193C 'bundl':196C 'cf7':86C,116C,131C 'chain':173C,206C 'class':52B,144C,201C 'code':9A,75B,100C,161C,170C 'configur':74B,182C 'connector':89C 'contact':21B,34B,83C 'contact-form':20B 'contactsheets':18A 'contactsheets-lite':17A 'craft':59B 'cve':11A,14A 'data':61B 'databas':41B,92C,136C 'due':126C 'e.g':118C 'execut':10A,76B,101C,160C,171C 'exploit':166C,204C 'featur':189C 'field':117C,133C 'form':5A,22B,35B,60B,84C,202C 'gadget':172C,205C 'googl':70B,87C,177C 'howev':207C 'includ':108C 'inject':66B,212C 'input':6A 'insuffici':128C 'lead':7A 'librari':199C 'lite':19A 'make':153C 'mayb':147C 'messag':121C 'monolog':197C 'non':114C 'non-system':113C 'object':65B,211C 'occur':213C 'packag':24B 'paramet':122C,123C 'php':25B,64B,210C 'plugin':3A,30B,93C,185C 'possibl':155C 'primari':187C 'regardless':214C 'remot':99C,169C 'requir':174C 'restrict':53B,145C 'retriev':50B,151C 'sanit':43B,129C 'save':33B,90C 'server':79B,164C 'sheet':71B,88C,178C 'storag':137C 'submiss':37B,132C 'submit':58B 'success':165C 'system':115C 'token':73B,180C 'trigger':63B,192C 'unauthent':4A,55B,157C 'under':209C 'unseri':46B,148C 'valu':38B,134C 'version':104C 'via':110C 'vulner':97C 'whose':200C 'without':42B,51B 'wordpress':1A,26B,32B,95C 'wpsyncsheet':2A,27B,29B,81C 'your-messag':119C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the WPSyncSheets For Contact Form 7 plugin (contactsheets-lite) version 1.8.0 or earlier that take Contact Form 7 submissions. Anyone can submit the crafted value; it is triggered when an admin views the stored entry. Code execution needs a Google Sheets token configured (loads Monolog gadget chain); object injection happens regardless. Sites without the plugin or on 1.8.1+ can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["contactsheetslite"],"ptokens":["contactsheets","lite"],"labels":["contactform7","high","package","php","wordpress","wpsyncsheets"],"campaign_type":null,"search_a":"'-104010':13A,16A '-2026':12A,15A 'code':9A 'contactsheets':18A 'contactsheets-lite':17A 'cve':11A,14A 'execut':10A 'form':5A 'input':6A 'lead':7A 'lite':19A 'plugin':3A 'unauthent':4A 'wordpress':1A 'wpsyncsheet':2A","search_b":"'7':23B,36B 'access':72B 'admin':49B 'attack':56B 'class':52B 'code':75B 'configur':74B 'contact':21B,34B 'contact-form':20B 'craft':59B 'data':61B 'databas':41B 'execut':76B 'form':22B,35B,60B 'googl':70B 'inject':66B 'object':65B 'packag':24B 'php':25B,64B 'plugin':30B 'restrict':53B 'retriev':50B 'sanit':43B 'save':33B 'server':79B 'sheet':71B 'submiss':37B 'submit':58B 'token':73B 'trigger':63B 'unauthent':55B 'unseri':46B 'valu':38B 'without':42B,51B 'wordpress':26B,32B 'wpsyncsheet':27B,29B","search_c":"'1.8.0':109C '2.10.0':198C '7':85C 'absenc':140C 'access':179C 'admin':150C 'advertis':188C 'allow':143C 'attack':158C 'autoload':193C 'bundl':196C 'cf7':86C,116C,131C 'chain':173C,206C 'class':144C,201C 'code':100C,161C,170C 'configur':182C 'connector':89C 'contact':83C 'databas':92C,136C 'due':126C 'e.g':118C 'execut':101C,160C,171C 'exploit':166C,204C 'featur':189C 'field':117C,133C 'form':84C,202C 'gadget':172C,205C 'googl':87C,177C 'howev':207C 'includ':108C 'inject':212C 'insuffici':128C 'librari':199C 'make':153C 'mayb':147C 'messag':121C 'monolog':197C 'non':114C 'non-system':113C 'object':211C 'occur':213C 'paramet':122C,123C 'php':210C 'plugin':93C,185C 'possibl':155C 'primari':187C 'regardless':214C 'remot':99C,169C 'requir':174C 'restrict':145C 'retriev':151C 'sanit':129C 'save':90C 'server':164C 'sheet':88C,178C 'storag':137C 'submiss':132C 'success':165C 'system':115C 'token':180C 'trigger':192C 'unauthent':157C 'under':209C 'unseri':148C 'valu':134C 'version':104C 'via':110C 'vulner':97C 'whose':200C 'wordpress':95C 'wpsyncsheet':81C 'your-messag':119C","first_public_at":"2026-11-06T12:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104010","severity":null,"published_at":"2026-11-06T12:17:15+00:00","modified_at":"2026-11-06T12:17:15+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","fetched_at":"2026-11-06T12:41:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-104010:1891","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contactsheets-lite/wpsyncsheets-for-contact-form-7-180-unauthenticated-php-object-injection-to-remote-code-execution-via-untrusted-cf7-submission-field-via-maybe-unserialize","severity":null,"published_at":"2026-11-06T12:43:49+00:00","modified_at":"2026-11-06T12:43:49+00:00","first_seen_at":"2026-11-06T12:43:49+00:00","fetched_at":"2026-11-06T12:43:49+00:00","note":"Wordfence (CNA, researcher GivMeInJ) advisory read: affected <=1.8.0, patched 1.8.1, requires admin viewing the stored entry (UI:R). Not exploited, no PoC found. Fix not verified: vendor changelog not read, only Wordfence and WordPress.org page (modified Nov 4).","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contactsheets-lite/wpsyncsheets-for-contact-form-7-180-unauthenticated-php-object-injection-to-remote-code-execution-via-untrusted-cf7-submission-field-via-maybe-unserialize","https://wordpress.org/plugins/contactsheets-lite/"]}],"documents":[{"id":86428,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contactsheets-lite/wpsyncsheets-for-contact-form-7-180-unauthenticated-php-object-injection-to-remote-code-execution-via-untrusted-cf7-submission-field-via-maybe-unserialize","title":"Wordfence: WPSyncSheets For Contact Form 7 <= 1.8.0 PHP Object Injection to RCE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":86429,"url":"https://wordpress.org/plugins/contactsheets-lite/","title":"WordPress.org: WPSyncSheets For Contact Form 7 plugin page","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}