# Redirection for Contact Form 7 <= 3.2.15 - Unauthenticated Insufficient Verification of Data Authenticity to Pre-Confirmed Personal Data Erasure/Export Request Creation

- **ID:** WPSEC-2026-2685
- **Plugin:** Redirection for Contact Form 7 (`wpcf7-redirect`), https://wordpress.org/plugins/wpcf7-redirect/
- **Affected versions:** from 2.6.0 before 3.2.16
- **Fixed in:** 3.2.16 (Update to 3.2.16 or later.)
- **Severity:** Medium 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpcf7-redirect
- **Fix released:** 2026-11-05
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2685/

## Description

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the 'Erase/Export Data Request' form action in all versions up to, and including, 3.2.15. This is due to the plugin creating the WordPress personal data request with a 'confirmed' status, so the account owner never has to verify it, whenever the action's 'Send confirmation email' option is unchecked, which is its default. This makes it possible for unauthenticated attackers to submit another user's username or email address through a public form that uses this action and file a pre-confirmed personal data erasure or export request for that person. If an administrator then acts on the request, believing the owner confirmed it, the victim's personal data may be erased without their consent.

## References

- https://wpsec.com/vuln/WPSEC-2026-2685/
- https://plugins.svn.wordpress.org/wpcf7-redirect/tags/3.2.16/
- https://wordpress.org/plugins/wpcf7-redirect/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2685/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.