{
 "id": "WPSEC-2026-2685",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2685/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2685/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2685/index.md",
 "title": "Redirection for Contact Form 7 <= 3.2.15 - Unauthenticated Insufficient Verification of Data Authenticity to Pre-Confirmed Personal Data Erasure/Export Request Creation",
 "description": "The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the 'Erase/Export Data Request' form action in all versions up to, and including, 3.2.15. This is due to the plugin creating the WordPress personal data request with a 'confirmed' status, so the account owner never has to verify it, whenever the action's 'Send confirmation email' option is unchecked, which is its default. This makes it possible for unauthenticated attackers to submit another user's username or email address through a public form that uses this action and file a pre-confirmed personal data erasure or export request for that person. If an administrator then acts on the request, believing the owner confirmed it, the victim's personal data may be erased without their consent.",
 "plugin": {
  "slug": "wpcf7-redirect",
  "name": "Redirection for Contact Form 7",
  "full_name": "Redirection for Contact Form 7",
  "wordpress_org": "https://wordpress.org/plugins/wpcf7-redirect/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpcf7-redirect/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpcf7-redirect"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.2,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.6.0",
    "from_inclusive": true,
    "to": "3.2.16",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.6.0 before 3.2.16"
  ]
 },
 "introduced_in": "2.6.0",
 "fixed_in": "3.2.16",
 "remediation": "Update to 3.2.16 or later.",
 "fix_released": "2026-11-05T23:50:43+00:00",
 "published": "2026-11-07T00:42:08+00:00",
 "updated": "2026-11-06T11:59:06.079035+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2685/",
  "https://plugins.svn.wordpress.org/wpcf7-redirect/tags/3.2.16/",
  "https://wordpress.org/plugins/wpcf7-redirect/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpcf7-redirect",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-07"
 }
}