CVE-2026-120659

MediumCVSS 5.3

Published: 06/11/2026(UTC)Updated: 06/11/2026(UTC)Translated: 06/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

37th percentile - higher than 37% of all known CVEs

Summary

The Redirection for Contact Form 7 plugin for WordPress (versions up to 3.2.14) has an authorization bypass because it does not properly verify user permissions. An unauthenticated attacker can write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory.

Risk Assessment

Unauthorized data writes and file copying, potentially leading to information disclosure or further exploitation.

Recommendation

Update the plugin to a version later than 3.2.14 or disable the Save Entry (Save Lead) action until patched.

Other vulnerabilities in Redirection for Contact Form 7 WordPress plugin

CVE-2026-80439Medium
The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output.

Original NVD description (English source)

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS