Pdf For Contact Form 7 Vulnerabilities

[en] Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Object Injection.This issue affects PDF for Contact Form 7: from n/a through <= 6.3.4.

Affected:

up to 6.3.4

Fix:

No patched version reported

Disclosed:

Dec 18, 2025

CVE-2025-60081 on NVD →

[en] The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to unauthorized post duplication due to a missing capability check on the 'rednumber_duplicate' function in all versions up to, and including, 6.3.3. This makes it possible for authenticated attackers, with Subscriber-le...

Affected:

up to 6.3.4

Fixed in:

6.3.4

Disclosed:

Dec 12, 2025

CVE-2025-14074 on NVD →

The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to unauthorized post duplication due to a missing capability check on the 'rednumber_duplicate' function in all versions up to, and including, 6.3.3. This makes it possible for authenticated attackers, with Subscriber-level a...

CVSS:

4.3

Affected:

up to 6.3.3

Fixed in:

6.3.4

Disclosed:

Dec 11, 2025

CVE-2025-14074 on NVD →

The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.0 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. N...

CVSS:

7.5

Affected:

up to 6.5.0

Fixed in:

6.5.1

Disclosed:

Aug 23, 2025

CVE-2025-60081 on NVD →