What is the CVSS score of CVE-2026-11395?

CVE-2026-11395 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of CF7 to Webhook are affected by CVE-2026-11395?

The CF7 to Webhook WordPress plugin (versions 5.0.0 and earlier) contains a vulnerability that allows external attackers to remotely manipulate how your WordPress servers communicate with external…

How to fix or mitigate CVE-2026-11395?

24 hours: Inventory all WordPress installations using CF7 to Webhook plugin versions ≤5.0.0; audit webhook configurations for CF7 field placeholders in host portions; identify publicly reachable Contact Form 7 forms. 7 days: Implement access restrictions (WAF rules, .htaccess, or authentication requirements) on vulnerable forms; contact plugin vendor regarding security updates; identify alternative webhook solutions. 30 days: Upgrade to patched version upon release, uninstall the plugin, or migrate to alternative webhook provider; conduct post-incident audit of all webhook configurations.

CF7 to Webhook CVE-2026-11395

EUVD-2026-37863 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-18 Wordfence

GHSA-g67p-9qph-gpr2

WordPress SSRF Wordpress Plugin Cf7 To Webhook

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Unauthenticated network reach (AV:N/PR:N/UI:N), but AC:H because exploitation depends on a non-default admin configuration placing a CF7 placeholder in the URL host; scope changes to internal services with limited C/I impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 08:03 vuln.today

CVE Published

Jun 18, 2026 - 06:50 cve.org

HIGH 7.2

DescriptionCVE.org

The CF7 to Webhook plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.0 via the pull_the_trigger. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires that the admin-configured webhook URL contains a Contact Form 7 field placeholder in the host segment of the URL, and that the affected form is publicly accessible.

Articles & Coverage 2

medium.com CVE-2026-11395: Unauthenticated SSRF Vulnerability Discovered Through Manual Methodology Jul 03, 2026 News 3 New WordPress Vulnerabilities - 3 High Severity Jun 19, 2026

AnalysisAI

Server-Side Request Forgery in the CF7 to Webhook WordPress plugin (versions up to and including 5.0.0) allows unauthenticated attackers to coerce the WordPress server into issuing arbitrary outbound HTTP requests through the pull_the_trigger functionality. Exploitation is conditional on an administrator configuring the webhook URL with a Contact Form 7 field placeholder inside the host portion of the URL, with the form publicly reachable. No public exploit identified at time of analysis, and there is no CISA KEV listing for this vulnerability.

Technical ContextAI

The vulnerability lives in the CF7 to Webhook plugin (vendor slug mariovalney/cf7_to_webhook, originally distributed under the cf7-to-zapier project), which forwards Contact Form 7 submissions to externally configured webhook URLs. The plugin permits administrators to template the destination URL with form field placeholders that are substituted with attacker-controlled submission values at the moment pull_the_trigger fires the outbound request (see class-module-zapier.php line 150 and class-module-cf7.php lines 351 and 524). Because substitution is performed without restricting where the placeholder may appear or validating that the resulting host resolves to a non-internal address, an attacker who can submit the form can rewrite the host segment itself - the classic CWE-918 Server-Side Request Forgery pattern, where the server-side HTTP client is the confused deputy.

RemediationAI

Upstream fix available (commit/changeset 3562661 on the cf7-to-zapier trac repository); a released patched version above 5.0.0 is not independently confirmed from the supplied data, so administrators should upgrade to the latest available CF7 to Webhook release published after that changeset and verify the installed version on the WordPress plugins screen. Until the upgrade is applied, the most effective compensating control is to audit every configured webhook URL and remove any Contact Form 7 field placeholder (the bracketed shortcode tokens) from the scheme and host portion of the URL - restricting placeholders to the path or query string eliminates the SSRF primitive, at the cost of losing dynamic host routing if any legitimate workflow relied on it. As a defense-in-depth layer, restrict the WordPress host's outbound HTTP egress at the network level so it cannot reach link-local cloud metadata endpoints (169.254.169.254), RFC1918 ranges, and loopback, accepting that this will also block any intentional integrations with internal services. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/caa5b9aa-e98c-48fc-9e63-0a1380465918?source=cve should be consulted for the authoritative fix version once published.