CVE-2026-120659 · Package
NO FIX YET
The Redirection for Contact Form 7 WordPress plugin does not check authorization on some actions, so an unauthenticated visitor can set arbitrary post meta values on new lead posts. An attacker can also copy server-side files with allowed MIME-type extensions into the plugin's uploads directory.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Redirection for Contact Form 7 WordPress plugin at version 3.2.14 or lower, where a published Contact Form 7 form has the Save Entry (Save Lead) action enabled. Sites without the plugin, or without that action on a published form, are not exposed.
Not affected if plugin-not-installed, plugin-updated, save-lead-disabled
Who cares contact-form-7, self-hosted, wordpress
Redirection for Contact Form 7 plugin is installed and its version is 3.2.14 or lower in the WordPress admin plugins list.No fix yet, per the sources.
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.