PT-2025-16559 · WordPress · Contact Form 7

Asaf Mozes · Published 2025-04-16 · Updated 2025-04-16 · CVE-2025-3247

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contact Form 7 versions up to, and including, 6.0.5

Description The issue is related to insufficient validation on a user-controlled key in the wpcf7 stripe skip spam check function, allowing unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Although only the first transaction is processed via Stripe, the plugin sends a successful email message for each transaction, potentially tricking an administrator into fulfilling each order.

Recommendations For versions up to, and including, 6.0.5, consider disabling the wpcf7 stripe skip spam check function as a temporary workaround until a patch is available. Restrict access to the Stripe PaymentIntent to minimize the risk of exploitation. Avoid using the wpcf7 stripe skip spam check function in transactions until the issue is resolved.

Fix

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2025-3247

Affected Products

Contact Form 7

References · 9

• https://osv.dev/vulnerability/CVE-2025-3247 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3270138 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-3247 · Security Note
• https://twitter.com/CVEnew/status/1912390845057097821 · Twitter Post
• https://t.me/cvedetector/23052 · Telegram Post
• https://plugins.trac.wordpress.org/browser/contact-form-7/tags/6.0.5/modules/stripe/stripe.php#L114 · Note
• https://t.me/cvetracker/21720 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1912421363232473533 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/38257dbf-288e-4028-af65-85f5389888ac?source=cve · Note