Redirection for Contact Form 7 <= 3.2.15 - Unauthenticated Insufficient Verification of Data Authenticity to Pre-Confirmed Personal Data Erasure/Export Request Creation
- ID
- WPSEC-2026-2685
- Plugin
- Redirection for Contact Form 7 (wpcf7-redirect)
- Affected
- from 2.6.0 before 3.2.16
- Remediation
- Update to 3.2.16 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
- Weakness
- CWE-345
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-07
- Attack surface
- Redirection for Contact Form 7 on WPSec AttackSurface
- Fix released
- Published
Description
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the 'Erase/Export Data Request' form action in all versions up to, and including, 3.2.15. This is due to the plugin creating the WordPress personal data request with a 'confirmed' status, so the account owner never has to verify it, whenever the action's 'Send confirmation email' option is unchecked, which is its default. This makes it possible for unauthenticated attackers to submit another user's username or email address through a public form that uses this action and file a pre-confirmed personal data erasure or export request for that person. If an administrator then acts on the request, believing the owner confirmed it, the victim's personal data may be erased without their consent.
References
- https://wpsec.com/vuln/WPSEC-2026-2685/
- https://plugins.svn.wordpress.org/wpcf7-redirect/tags/3.2.16/
- https://wordpress.org/plugins/wpcf7-redirect/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS