CF7 Redirection CVE-2026-111574

Exploitation requires that the Redirection for Contact Form 7 plugin's DEBUG MODE be explicitly enabled (a non-default operator configuration) so that submitted form data is retained and rendered in the lead debug metabox. To plant the payload no authentication or user interaction is needed - any visitor can submit a form (PR:N). However, the stored script only executes when a LOGGED-IN user (typically an administrator) opens the specific crafted lead entry's debug metabox in wp-admin (UI:R), making a privileged victim's action the trigger. Limiting factors that reduce realistic risk: the dependence on the non-default debug mode being on, the need for an authenticated admin to view the exact malicious entry, and the plugin version being in the 2.2.7-to-before-3.2.12 range; sites on 3.2.12+ or with debug mode off are not exploitable.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in the Redirection for Contact Form 7 plugin for versions before 3.2.12. The signals are mixed and point to a moderate, conditional risk rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) correctly reflects that the attack is remote and requires no authentication to plant the payload (an attacker just submits a contact form), but carries high attack complexity (AC:H) and required user interaction (UI:R) - the injected script only fires if (a) the plugin's debug mode is enabled, a non-default operator setting, and (b) a logged-in user subsequently opens the specific lead entry in the debug metabox. The input's C:H/I:H/A:H impact ratings (yielding 7.5) are aggressive for a stored XSS payload executing in an administrator's browser session; a more defensible impact for client-side script execution is limited confidentiality/integrity with no availability loss, which is why my independent assessment lands lower (~6.1). On exploitation signals: a public exploit/advisory exists via WPScan (publicly available exploit code exists), but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation - the POC should not be conflated with in-the-wild use. No SSVC decision data was provided. Net: a real, patch-worthy issue for sites running this plugin with debug mode on, but the dependence on a non-default setting plus required admin interaction materially constrains real-world risk. Note the conflict to verify with the vendor: the input vector rates full High impact across C/I/A for what is a client-side script injection, which likely overstates technical impact.

An unauthenticated attacker submits a Contact Form 7 form on a target WordPress site, embedding a malicious JavaScript payload in a form field; the plugin stores this submission as a lead entry without sanitizing or escaping it. When a site administrator who has the plugin's debug mode enabled later opens that lead entry's debug metabox in wp-admin, the script executes in their authenticated browser session, potentially enabling session/cookie theft or admin actions on their behalf. A public write-up/exploit is available from WPScan, lowering the barrier to reproduction, though exploitation still requires debug mode to be enabled and an admin to view the crafted entry.