Description

The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-09-06T10:17:14.810Z",
  "pubdate": "2026-09-06T10:17:14.810Z",
  "executiveSummary": "The Redirection for Contact Form 7 WordPress plugin is susceptible to an arbitrary shortcode execution vulnerability occurring through improper input validation and handling.\nThe vulnerability type is categorized as an improper neutralization of input during web page generation, specifically leading to Stored Cross-Site Scripting or arbitrary code execution via shortcodes.\nAffected systems include the Redirection for Contact Form 7 plugin in versions 2.2.7 through 3.2.10.\nThis flaw allows unauthenticated remote attackers to inject malicious shortcodes into form submissions.\nWhen these submissions are processed by the plugin's action settings, the injected shortcodes are executed, potentially allowing unauthorized access to sensitive information or the output of other installed plugins.\nThe impact is significant, as it grants attackers the ability to execute any registered shortcode on the WordPress installation without requiring prior authentication or administrative privileges.\nThe risk is critical due to the ease of exploitation and the potential for complete exposure of private site data.",
  "technicalDetails": "The vulnerability resides in the plugin's architectural handling of submitted form data when processing redirection actions. The root cause is the failure to sanitize or neutralize user-supplied content within form fields before that content is processed by the WordPress do_shortcode() function or a similar execution handler.\nIn affected versions, the plugin takes user input from a Contact Form 7 submission and substitutes those values directly into action settings. The application subsequently parses these settings for shortcodes to facilitate dynamic redirection behaviors.\nAn attacker can exploit this by submitting a crafted value into a contact form field that contains a malicious or sensitive shortcode (e.g., [private_data_shortcode]). Because the plugin processes these settings by triggering shortcode expansion, the server executes the injected shortcode server-side.\nThe attack flow follows these steps: 1. The attacker identifies a form managed by the Redirection for Contact Form 7 plugin. 2. The attacker submits the form, inserting an arbitrary shortcode into a field that the plugin is configured to use within its redirection logic. 3. The plugin receives the data and stores it in the action's configuration. 4. During the redirection processing phase, the plugin retrieves the stored configuration and passes the unsanitized input through a shortcode evaluation routine. 5. The server executes the shortcode, and the resulting output is processed by the plugin, potentially returning the execution results directly to the attacker or exposing the output within the application's response context.\nThis vulnerability requires no authentication, as it targets the public-facing contact form interface. The exposure is network-based, meaning any visitor capable of reaching the contact form can initiate the payload. The impact is broad, as the attacker is limited only by the shortcodes registered on the specific WordPress environment; this can range from simple information disclosure (e.g., querying private pages or internal user data) to complex interaction with other plugin functionalities that may be reachable via shortcode triggers."
}