---
id: "CVE-2026-121873"
page: "https://infrastack.ai/live/CVE-2026-121873"
kind: "vulnerability"
aliases: ["CVE-2026-121873"]
title: "Redirection for Contact Form 7: unverified email lets visitors forge data requests"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["gdpr", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "version-3.2.16-or-later"]
published_at: "2026-11-11T06:17:17+00:00"
first_seen_at: "2026-11-11T06:25:42+00:00"
updated_at: "2026-11-11T06:27:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121873", "first_seen_at": "2026-11-11T06:25:42+00:00"}]
exploit_sources: []
---

# Redirection for Contact Form 7: unverified email lets visitors forge data requests

Link for people: https://infrastack.ai/live/CVE-2026-121873 (this .md is for agents)

The Redirection for Contact Form 7 WordPress plugin accepts an email address in its data request form without checking that the requester owns it, and records the request as already confirmed by default. An unauthenticated visitor can therefore create verified WordPress personal data erasure or export requests for addresses they do not control.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get redirection-for-contact-form-7 --field=version`
- Look for pending or confirmed personal data requests submitted for addresses that do not belong to real users

## Fix

- Redirection for Contact Form 7 plugin: move to `3.2.16` or later

## Timeline

- 2026-11-11T06:25:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121873

## From the sources

The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_