Is CVE-2026-120659 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120659 being exploited in the wild.

How severe is CVE-2026-120659?

Medium severity, with a CVSS score of 5.3, published 6 November 2026.

Which products and versions are affected?

WebFactory Ltd Redirection for Contact Form 7 up to 3.2.14.

Is there a fix for CVE-2026-120659?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-120659 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-120659?

Check whether you run WebFactory Ltd Redirection for Contact Form 7 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120659: Redirection for Contact Form 7 authorization bypass

CVE-2026-120659 · Severity: medium · CVSS 5.3 · Published 2026-11-06

The Redirection for Contact Form 7 WordPress plugin, used to manage form submissions and data capture, fails to verify user authorization in its lead-saving functionality. An unauthenticated attacker can exploit this to modify post metadata and upload arbitrary files to the server, potentially exposing sensitive data or creating a foothold for further compromise when a Contact Form 7 form with Save Entry enabled is published.

Vendors: WebFactory Ltd.

Quick answers

Is CVE-2026-120659 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120659 being exploited in the wild.
How severe is CVE-2026-120659?: Medium severity, with a CVSS score of 5.3, published 6 November 2026.
Which products and versions are affected?: WebFactory Ltd Redirection for Contact Form 7 up to 3.2.14.
Is there a fix for CVE-2026-120659?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-120659 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-120659?: Check whether you run WebFactory Ltd Redirection for Contact Form 7 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin fails to properly authorize actions before writing post meta values and uploading files, allowing unauthenticated attackers to execute these operations through network requests. The vulnerability affects the Save Lead action when triggered on a published Contact Form 7 form; successful exploitation grants an attacker the ability to arbitrarily modify post metadata and copy server-side files with certain MIME types into the plugin's uploads directory.

Affected products

WebFactory Ltd Redirection for Contact Form 7 up to 3.2.14

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.