{
 "id": "WPSEC-2026-3128",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3128/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3128/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3128/index.md",
 "title": "Redirection for Contact Form 7 <= 3.2.17 - Unauthenticated CSV Injection via Lead Export",
 "description": "The Redirection for Contact Form 7 plugin for WordPress is vulnerable to CSV Injection via form submissions stored as leads in all versions up to, and including, 3.2.17, due to insufficient neutralization of formula characters in lead values and field names written to the leads CSV export. This makes it possible for unauthenticated attackers to submit form values beginning with characters such as =, +, - or @ that are interpreted as spreadsheet formulas when an administrator exports the leads and opens the file in a vulnerable spreadsheet application.",
 "plugin": {
  "slug": "wpcf7-redirect",
  "name": "Redirection for Contact Form 7",
  "full_name": "Redirection for Contact Form 7",
  "wordpress_org": "https://wordpress.org/plugins/wpcf7-redirect/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpcf7-redirect/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpcf7-redirect"
 },
 "type": "CSV INJECTION",
 "cwe": [
  "CWE-1236"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.3.0",
    "from_inclusive": true,
    "to": "3.2.18",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.3.0 before 3.2.18"
  ]
 },
 "introduced_in": "2.3.0",
 "fixed_in": "3.2.18",
 "remediation": "Update to 3.2.18 or later.",
 "fix_released": "2026-11-13T07:56:53+00:00",
 "published": "2026-11-14T08:41:05+00:00",
 "updated": "2026-11-13T15:52:45.536309+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3128/",
  "https://plugins.svn.wordpress.org/wpcf7-redirect/tags/3.2.18/",
  "https://wordpress.org/plugins/wpcf7-redirect/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpcf7-redirect",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-14"
 }
}