CVE-2025-2485

Summary

CVE-2025-2485 is a vulnerability affecting the Drag and Drop Multiple File Upload feature of Contact Form 7 plugin for WordPress. The issue, present in versions up to 1.3.8.7, allows unauthenticated attackers to inject PHP Objects through a PHAR file due to deserialization of untrusted input. However, this vulnerability has no impact without an additional plugin or theme containing a Post-exploitation chain (POP chain) installed on the site. If such a chain is present, attackers may delete files, retrieve sensitive data, or execute code. The Flamingo plugin must be installed and activated to exploit this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.