CVE-2026-121873 · Package
NO FIX YET · SEE WHAT TO DO
The Redirection for Contact Form 7 WordPress plugin accepts an email address in its data request form without checking that the requester owns it, and records the request as already confirmed by default. An unauthenticated visitor can therefore create verified WordPress personal data erasure or export requests for addresses they do not control.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Redirection for Contact Form 7 WordPress plugin before 3.2.16 that expose its data request form to visitors are exposed. Sites without the plugin, or running 3.2.16 or later, are not affected.
Not affected if plugin-not-installed, version-3.2.16-or-later
Who cares gdpr, wordpress, wordpress-plugin
wp plugin get redirection-for-contact-form-7 --field=version3.2.16 or laterThe Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.