---
id: "CVE-2026-104010"
page: "https://infrastack.ai/live/CVE-2026-104010"
kind: "vulnerability"
aliases: ["CVE-2026-104010"]
title: "WordPress WPSyncSheets plugin: unauthenticated form input leads to code execution"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "contactsheets-lite", "fixed": ["1.8.1"], "affected": "<= 1.8.0", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["contact-form-7", "package", "php", "wordpress", "wpsyncsheets"]
not_affected_if: ["plugin-1.8.1-or-newer", "plugin-newer-than-1.8.0", "plugin-not-installed"]
published_at: "2026-11-06T12:17:15+00:00"
first_seen_at: "2026-11-06T12:41:48+00:00"
updated_at: "2026-11-06T12:43:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104010", "first_seen_at": "2026-11-06T12:41:48+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contactsheets-lite/wpsyncsheets-for-contact-form-7-180-unauthenticated-php-object-injection-to-remote-code-execution-via-untrusted-cf7-submission-field-via-maybe-unserialize", "first_seen_at": "2026-11-06T12:43:49+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contactsheets-lite/wpsyncsheets-for-contact-form-7-180-unauthenticated-php-object-injection-to-remote-code-execution-via-untrusted-cf7-submission-field-via-maybe-unserialize", "https://wordpress.org/plugins/contactsheets-lite/"]}]
exploit_sources: []
---

# WordPress WPSyncSheets plugin: unauthenticated form input leads to code execution

Link for people: https://infrastack.ai/live/CVE-2026-104010 (this .md is for agents)

The WPSyncSheets plugin for WordPress saves Contact Form 7 submission values to the database without sanitizing them, then unserializes them in admin retrieval without class restrictions. An unauthenticated attacker can submit crafted form data that triggers PHP object injection and, with a Google Sheets access token configured, code execution on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:contactsheets-lite affected <= 1.8.0 fixed 1.8.1

## How to check

- WordPress admin > Plugins: find 'WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database' (slug contactsheets-lite); version 1.8.0 or lower is affected, 1.8.1 is patched.
- WP-CLI: wp plugin get contactsheets-lite --field=version
- A Google Sheets connection (access token) in the plugin settings makes the code-execution chain reachable via the bundled Monolog 2.10.0; without it the PHP object injection still occurs.
- Look in the plugin's saved entries for submission values beginning with O: or a: (serialized PHP), and do not open such entries in the admin until updated.

## Fix

Update WPSyncSheets For Contact Form 7 (slug contactsheets-lite) to 1.8.1 or newer (Wordfence: patched version 1.8.1).

## Timeline

- 2026-11-06T12:41:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104010
- 2026-11-06T12:43:49+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contactsheets-lite/wpsyncsheets-for-contact-form-7-180-unauthenticated-php-object-injection-to-remote-code-execution-via-untrusted-cf7-submission-field-via-maybe-unserialize — Wordfence (CNA, researcher GivMeInJ) advisory read: affected <=1.8.0, patched 1.8.1, requires admin viewing the stored entry (UI:R). Not exploited, no PoC found. Fix not verified: vendor changelog not read, only Wordfence and WordPress.org page (modified Nov 4).

## Documents

- [advisory] Wordfence: WPSyncSheets For Contact Form 7 <= 1.8.0 PHP Object Injection to RCE https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contactsheets-lite/wpsyncsheets-for-contact-form-7-180-unauthenticated-php-object-injection-to-remote-code-execution-via-untrusted-cf7-submission-field-via-maybe-unserialize
- [describes] WordPress.org: WPSyncSheets For Contact Form 7 plugin page https://wordpress.org/plugins/contactsheets-lite/

## From the sources

The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field (e.g., your-message)' parameter parameter. This is due to insufficient sanitization of CF7 submission field values before database storage and the absence of an allowed_classes restriction on maybe_unserialize() during admin retrieval. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation of the remote code execution gadget chain requires that a Google Sheets access token be configured in the plugin (its primary advertised feature), as this triggers autoloading of the bundled Monolog 2.10.0 library whose classes form the exploitable gadget chain; however, the underlying PHP Object Injection occurs regardless.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_