The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress contains a PHP Object Injection vulnerability in versions up to 1.4.7. The vulnerability exists in the 'download_csv' function due to deserialization of untrusted input. Unauthenticated attackers can inject PHP objects, but the vulnerability has no direct impact unless a POP chain is present via another plugin or theme. If a POP chain exists, attackers could potentially delete files, retrieve sensitive data, or execute code.