Vulnerabilities / Redirection for Contact Form 7 / WPSEC-2026-3128
Redirection for Contact Form 7 <= 3.2.17 - Unauthenticated CSV Injection via Lead Export
Medium 4.7
CWE-1236Fixed in 3.2.18
- ID
- WPSEC-2026-3128
- Plugin
- Redirection for Contact Form 7 (wpcf7-redirect)
- Affected
- from 2.3.0 before 3.2.18
- Remediation
- Update to 3.2.18 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-1236
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-14
- Attack surface
- Redirection for Contact Form 7 on WPSec AttackSurface
- Fix released
- Published
Description
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to CSV Injection via form submissions stored as leads in all versions up to, and including, 3.2.17, due to insufficient neutralization of formula characters in lead values and field names written to the leads CSV export. This makes it possible for unauthenticated attackers to submit form values beginning with characters such as =, +, - or @ that are interpreted as spreadsheet formulas when an administrator exports the leads and opens the file in a vulnerable spreadsheet application.
References
- https://wpsec.com/vuln/WPSEC-2026-3128/
- https://plugins.svn.wordpress.org/wpcf7-redirect/tags/3.2.18/
- https://wordpress.org/plugins/wpcf7-redirect/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS