PT-2025-33893 · WordPress · Redirection For Contact Form 7

Phat Rio · Published 2025-08-20 · Updated 2025-08-20 · CVE-2025-8141

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Redirection for Contact Form 7 versions up to and including 3.2.4

Description: The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete associated files function. This allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution when specific files, such as wp-config.php, are deleted.

Recommendations: Update Redirection for Contact Form 7 to a version later than 3.2.4.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-8141

Affected Products

Redirection For Contact Form 7

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-8141 · Security Note
• https://t.me/CVEtracker/30425 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.3/classes/class-wpcf7r-save-files.php#L80 · Note
• https://twitter.com/CveFindCom/status/1957996156639691129 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/fafd0159-25ab-430d-88ef-c4d09d23baa7?source=cve · Note
• https://twitter.com/CVEnew/status/1958010999727858093 · Twitter Post