{"id":"CVE-2026-121873","kind":"vulnerability","aliases":["CVE-2026-121873"],"related":[],"title":"Redirection for Contact Form 7: unverified email lets visitors forge data requests","description":"The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control.","summary":"The Redirection for Contact Form 7 WordPress plugin accepts an email address in its data request form without checking that the requester owns it, and records the request as already confirmed by default. An unauthenticated visitor can therefore create verified WordPress personal data erasure or export requests for addresses they do not control.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gdpr","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","version-3.2.16-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get redirection-for-contact-form-7 --field=version`\n- Look for pending or confirmed personal data requests submitted for addresses that do not belong to real users","fix":"- Redirection for Contact Form 7 plugin: move to `3.2.16` or later","status":"open","published_at":"2026-11-11T06:17:17+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","triaged_at":"2026-11-11T06:27:28+00:00","updated_at":"2026-11-11T06:27:28+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:27:28Z","model":"claude-haiku-5-5","output":{"fix":"- Redirection for Contact Form 7 plugin: move to `3.2.16` or later","reach":"internet","title":"Redirection for Contact Form 7: unverified email lets visitors forge data requests","impact":"medium","summary":"The Redirection for Contact Form 7 WordPress plugin accepts an email address in its data request form without checking that the requester owns it, and records the request as already confirmed by default. An unauthenticated visitor can therefore create verified WordPress personal data erasure or export requests for addresses they do not control.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","gdpr"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"forged personal data erasure or export requests get processed as confirmed","analyst_note":"Product ranges were not provided; confirm the fixed version against the plugin's WordPress.org listing.\n","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get redirection-for-contact-form-7 --field=version`\n- Look for pending or confirmed personal data requests submitted for addresses that do not belong to real users","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-3.2.16-or-later"],"who_is_affected":"Sites running the Redirection for Contact Form 7 WordPress plugin before 3.2.16 that expose its data request form to visitors are exposed. Sites without the plugin, or running 3.2.16 or later, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000748,"input_tokens":4553,"output_tokens":586,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121873':15A,18A '-2026':14A,17A '3.2.16':87C '7':5A,30B,83C 'accept':33B 'action':102C 'address':36B,73B,95C,127C 'allow':113C 'alreadi':54B,111C 'check':43B 'confirm':55B,112C 'contact':3A,28B,81C 'control':77B,131C 'creat':63B,117C 'cve':13A,16A 'data':11A,39B,67B,99C,121C 'default':57B,105C 'email':7A,35B,94C 'erasur':68B,122C 'export':70B,124C 'forg':10A 'form':4A,29B,41B,82C,101C 'gdpr':19B 'let':8A 'own':47B 'ownership':91C 'packag':20B 'person':66B,120C 'plugin':24B,32B,85C 'record':50B,106C 'redirect':1A,26B,79C 'request':12A,40B,46B,52B,71B,100C,109C,125C 'result':108C 'suppli':96C 'therefor':62B 'unauthent':59B,114C 'unverifi':6A 'verifi':64B,90C,118C 'visitor':9A,60B,115C 'without':42B 'wordpress':21B,23B,31B,65B,84C,119C 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Redirection for Contact Form 7 WordPress plugin before 3.2.16 that expose its data request form to visitors are exposed. Sites without the plugin, or running 3.2.16 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gdpr","medium","package","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-121873':15A,18A '-2026':14A,17A '7':5A 'contact':3A 'cve':13A,16A 'data':11A 'email':7A 'forg':10A 'form':4A 'let':8A 'redirect':1A 'request':12A 'unverifi':6A 'visitor':9A","search_b":"'7':30B 'accept':33B 'address':36B,73B 'alreadi':54B 'check':43B 'confirm':55B 'contact':28B 'control':77B 'creat':63B 'data':39B,67B 'default':57B 'email':35B 'erasur':68B 'export':70B 'form':29B,41B 'gdpr':19B 'own':47B 'packag':20B 'person':66B 'plugin':24B,32B 'record':50B 'redirect':26B 'request':40B,46B,52B,71B 'therefor':62B 'unauthent':59B 'verifi':64B 'visitor':60B 'without':42B 'wordpress':21B,23B,31B,65B 'wordpress-plugin':22B","search_c":"'3.2.16':87C '7':83C 'action':102C 'address':95C,127C 'allow':113C 'alreadi':111C 'confirm':112C 'contact':81C 'control':131C 'creat':117C 'data':99C,121C 'default':105C 'email':94C 'erasur':122C 'export':124C 'form':82C,101C 'ownership':91C 'person':120C 'plugin':85C 'record':106C 'redirect':79C 'request':100C,109C,125C 'result':108C 'suppli':96C 'unauthent':114C 'verifi':90C,118C 'visitor':115C 'wordpress':84C,119C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121873","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121873","severity":null,"published_at":"2026-11-11T06:17:17+00:00","modified_at":"2026-11-11T06:17:17+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","fetched_at":"2026-11-11T06:25:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}