CVE-2026-80439

MediumCVSS 4.8

Published: 06/09/2026(UTC)Updated: 08/09/2026(UTC)Translated: 06/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output.

Risk Assessment

An attacker could execute arbitrary shortcodes, potentially leading to data disclosure or unauthorized actions within the site context.

Recommendation

Update the Redirection for Contact Form 7 plugin to version 3.2.11 or later.

Other vulnerabilities in Redirection for Contact Form 7 WordPress plugin

CVE-2026-120659Medium
The Redirection for Contact Form 7 plugin for WordPress (versions up to 3.2.14) has an authorization bypass because it does not properly verify user permissions. An unauthenticated attacker can write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS