Executive brief
The Redirection for Contact Form 7 WordPress plugin processes user-submitted form values without properly sanitizing shortcode syntax, allowing unauthenticated attackers to execute arbitrary shortcodes on the website. An attacker can craft a malicious form submission that embeds shortcode tags in form fields, causing the server to execute those shortcodes and potentially leak sensitive information or compromise site functionality.
Technical details
The vulnerability is an arbitrary shortcode execution flaw (CWE-94: Improper Control of Generation of Code) in how the plugin substitutes form field values into action settings and then processes those settings for shortcode expansion. When a Contact Form 7 form is configured with a Redirection action that embeds a form field in the custom redirect URL (e.g., https://thanks.example/landing?name=[your-name]), submitted values containing shortcode syntax like [audio src=...] are not escaped before shortcode processing. An unauthenticated attacker can POST to the wp-json/contact-form-7/v1/contact-forms/{id}/feedback endpoint with malicious shortcode payloads in form fields; the server executes the shortcode and returns the rendered output in the redirect_url response field. The vulnerability affects Redirection actions, Erase/Export Data Request actions, and Fire JavaScript actions when configured to use form field substitution. The issue was patched in version 3.2.11.
Affected products
- Wordpress.org Redirection for Contact Form 7 2.2.7 to 3.2.10
Timeline
- 2026-09-03: disclosed
- 2026-09-06: advisory: Published on NVD
- 2026-09-06: patched: Fixed in version 3.2.11