CVE-2026-80439
Received Received - Intake

Redirection for Contact Form 7 Shortcode Execution Flaw

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: WPScan

Description
The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-80439
EUVD
EUVD-2026-72091

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redirection_for_contact_form_7 plugin From 2.2.7 (inc) to 3.2.10 (inc)
redirection_for_contact_form_7 plugin 3.2.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Redirection for Contact Form 7 WordPress plugin versions 2.2.7 through 3.2.10. It allows unauthenticated users to execute arbitrary shortcodes by submitting form values that are then processed in action settings. This can lead to the execution of any shortcode registered on the site, potentially exposing sensitive output.

Detection Guidance

Check the installed version of the Redirection for Contact Form 7 plugin. If it is between 2.2.7 and 3.2.10, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

An attacker could exploit this to run malicious shortcodes, access sensitive data, or perform unauthorized actions on your WordPress site. This includes reading private information or executing code if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance. Exposure of such data may result in legal penalties and reputational damage.

Mitigation Strategies

Update the Redirection for Contact Form 7 plugin to version 3.2.11 or later immediately. If updating is not possible, disable the plugin temporarily until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80439. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart