PT-2025-52586 · WordPress · Redirection For Contact Form 7

Liontree · Published 2025-12-21 · Updated 2025-12-26 · CVE-2025-14800

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contact Form 7 Redirection plugin for WordPress versions up to and including 3.2.7

Description The plugin is susceptible to arbitrary file uploads because of a lack of file type validation within the move file to upload function. This allows unauthenticated attackers to copy arbitrary files on the server of the affected site. If the PHP configuration setting allow url fopen is enabled, attackers can upload remote files to the server.

Recommendations Update to a version beyond 3.2.7.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-14800

Affected Products

Redirection For Contact Form 7

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-14800 · Security Note
• https://plugins.trac.wordpress.org/changeset/3423970/wpcf7-redirect · Note
• https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.7/classes/class-wpcf7r-save-files.php#L180 · Note
• https://t.me/cveNotify/146467 · Telegram Post
• https://twitter.com/TheHackerWire/status/2003432184724783395 · Twitter Post
• https://t.me/CVEtracker/40371 · Telegram Post
• https://twitter.com/cracbot/status/2004507537106940207 · Twitter Post
• https://twitter.com/RedPacketSec/status/2002692067793772692 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b249ec90-a364-4644-94fb-d42eb6cc4d9a?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2002665952580636993 · Twitter Post
• https://twitter.com/CVEnew/status/2002835918269342025 · Twitter Post