# Redirection for Contact Form 7 <= 3.2.17 - Unauthenticated CSV Injection via Lead Export

- **ID:** WPSEC-2026-3128
- **Plugin:** Redirection for Contact Form 7 (`wpcf7-redirect`), https://wordpress.org/plugins/wpcf7-redirect/
- **Affected versions:** from 2.3.0 before 3.2.18
- **Fixed in:** 3.2.18 (Update to 3.2.18 or later.)
- **Severity:** Medium 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-1236
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpcf7-redirect
- **Fix released:** 2026-11-13
- **Published:** 2026-11-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3128/

## Description

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to CSV Injection via form submissions stored as leads in all versions up to, and including, 3.2.17, due to insufficient neutralization of formula characters in lead values and field names written to the leads CSV export. This makes it possible for unauthenticated attackers to submit form values beginning with characters such as =, +, - or @ that are interpreted as spreadsheet formulas when an administrator exports the leads and opens the file in a vulnerable spreadsheet application.

## References

- https://wpsec.com/vuln/WPSEC-2026-3128/
- https://plugins.svn.wordpress.org/wpcf7-redirect/tags/3.2.18/
- https://wordpress.org/plugins/wpcf7-redirect/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3128/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.