Contact Form 7 CVE-2026-14236

The exploitation requires the victim to click a crafted link while the Contact Form 7 plugin is configured to use Stripe checkout. No authentication is needed. The attacker must supply a return URL that is not validated by the plugin. The vulnerability affects all configurations that use Stripe integration with user-supplied return URLs. There are no special conditions beyond the presence of the plugin and a user interaction.

The CVSS vector indicates a network-based attack with low complexity, no privileges required, but user interaction is required (victim must click a crafted link). The scope is changed, meaning the redirect affects a resource beyond the plugin's scope (the user's browser). Confidentiality impact is low (potential information disclosure if the redirect leads to a phishing page), but integrity and availability are not impacted. Although publicly available exploit code exists, there is no mention of CISA KEV or EPSS data, suggesting this is a lower-risk vulnerability that can be exploited only through social engineering. The SSVC decision would likely be 'medium' priority given the exploitation status (POC available but not actively exploited) and the necessity of user interaction.

An attacker crafts a malicious link containing a specially crafted return URL pointing to a phishing site. The victim, who is using a site with Contact Form 7 and Stripe checkout, clicks the link during the checkout process. After the checkout completes, the victim is redirected to the attacker's site, potentially leading to credential theft or malware download. A publicly available exploit code exists, lowering the barrier for attackers.