Description

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-11-06T10:16:37.220Z",
  "pubdate": "2026-11-06T10:16:37.220Z",
  "executiveSummary": "The Redirection for Contact Form 7 plugin is susceptible to an authorization bypass vulnerability affecting all versions up to and including 3.2.14. The flaw resides in the plugin's failure to perform adequate access control checks, allowing unauthenticated attackers to perform unauthorized administrative actions.\nThe vulnerability enables remote, unauthenticated threat actors to inject arbitrary post meta data into 'lead' posts generated by the plugin and execute arbitrary server-side file copies. An attacker can move files with allowed MIME-type extensions into the plugin's designated uploads directory, potentially leading to information disclosure or the staging of malicious assets.\nSuccessful exploitation requires the presence of at least one published Contact Form 7 form that has the 'Save Entry' (Save Lead) functionality enabled. The risk implication is significant as it permits unauthorized data modification and file system manipulation within the WordPress environment, bypassing intended security boundaries. No specific user privileges are required for an attacker to initiate this exploit, making it highly accessible to external malicious actors with network connectivity to the target application.",
  "technicalDetails": "The root cause of this vulnerability is a critical failure in the authorization logic within the Redirection for Contact Form 7 plugin. The implementation lacks sufficient capability checks or nonce verification for requests targeting the submission handling logic associated with the 'Save Entry' feature. By failing to validate the authorization level of the request sender, the plugin permits unauthenticated actors to interface with internal API endpoints or processing hooks that were intended to be restricted to administrative or authorized users.\nThe exploitation flow initiates when an attacker targets a site running a vulnerable version of the plugin that has at least one Contact Form 7 form configured with the 'Save Entry' (Save Lead) action enabled. The attacker crafts an HTTP request designed to interact with the plugin's submission processor. Because the plugin does not verify the requester's identity, the application processes the input as if it were a legitimate submission.\nBy manipulating the request parameters, an attacker can perform two primary malicious operations. First, they can inject arbitrary post meta values into the 'lead' posts created by the system. This allows for the corruption of post data, which may be leveraged to manipulate content, alter submission details, or influence further administrative processing steps that rely on post meta integrity. Second, the attacker can leverage the lack of authorization to trigger server-side file operations. Specifically, the vulnerability permits the copying of existing server-side files into the plugin's uploads directory, provided the files possess extensions that the plugin recognizes as having allowed MIME-types. This effectively allows an attacker to exfiltrate or relocate sensitive files within the web server environment to locations that may be accessible to the public or facilitate further exploitation phases.\nThis vulnerability is classified as an authorization bypass, as the vulnerable component (the submission processing logic for lead storage) fails to enforce access restrictions. The exploitation is entirely remote and requires no authentication, allowing attackers to perform these operations over the network. Given that the plugin is active, the attack vector is limited only by the presence of a target form with 'Save Entry' enabled, which is a common configuration for sites utilizing this plugin for lead management. The post-exploitation impact includes unauthorized data modification, potential information leakage through the relocation of sensitive files, and the establishment of persistent unauthorized data entries within the WordPress database."
}