CVE-2025-8289
BaseFortify
Publication date: 2025-08-20
Last updated on: 2025-08-20
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | contact_form_7 | * |
| wordpress | wpcf7-redirect | 3.2.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Redirection for Contact Form 7 plugin for WordPress (up to version 3.2.4) and involves PHP Object Injection via deserialization of untrusted input in the delete_associated_files function. It allows unauthenticated attackers to inject a PHP object if a form with a file upload action is present and the 'Redirection For Contact Form 7 Extension - Create Post' extension is installed and activated. The vulnerability requires a PHP version of 8 or lower and the presence of a POP chain in another plugin or theme to be exploitable. If exploitable, it can lead to arbitrary file deletion, retrieval of sensitive data, or code execution depending on the POP chain available.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to delete arbitrary files, retrieve sensitive data, or execute code on the affected WordPress site. This can lead to data loss, unauthorized access to sensitive information, and potential full compromise of the website.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update or remove the Redirection for Contact Form 7 plugin if it is at version 3.2.4 or below. Also, ensure that the 'Redirection For Contact Form 7 Extension - Create Post' extension is not installed or activated if not necessary. Additionally, verify that your PHP version is greater than 8, as the vulnerability does not affect PHP versions above 8. Finally, review installed plugins and themes for any potential POP chains that could be exploited in conjunction with this vulnerability.