CVE-2026-121873: Redirection for Contact Form 7 2.6.0 - 3.2.15 - Unauthenticated Forged Personal Data Request Creation
The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed by default?
Sites using Redirection for Contact Form 7 versions before 3.2.16 are affected when the plugin's data request form action is available. The vulnerable behavior occurs by default because requests are recorded as already confirmed.
What does an attacker need to exploit this issue?
An attacker only needs unauthenticated access to the data request form action and an email address to submit. They do not need to control or verify the supplied email address.
What is the impact of a forged request?
An attacker can create a WordPress personal data erasure or export request for an email address they do not control. The request is recorded as verified despite the lack of email ownership verification.
How can administrators determine whether they may already be affected?
Review personal data erasure and export requests for entries marked confirmed or verified, especially where there is no evidence that the email owner initiated or confirmed the request. Also check whether the installed plugin version is earlier than 3.2.16.