🔎 Have you found a vulnerability in a WordPress plugin or theme? Report vulnerabilities in WordPress plugins and themes through our bug bounty program and earn a bounty on all in-scope submissions, while we handle the responsible disclosure process on your behalf.

Redirection for Contact Form 7

Wordfence Intelligence > Vulnerability Database > WordPress Plugins > Redirection for Contact Form 7

Information

Software Type	Plugin
Software Slug	wpcf7-redirect (view on wordpress.org)
Software Status	Active
Software Author	themeisle
Software Downloads	3,717,923
Software Active Installs	300,000
Software Record Last Updated	July 26, 2024

11 Vulnerabilities

Redirection for Contact Form 7 <= 2.9.2 - Missing Authorization

5.3

CVE-2023-39920

Oct 3, 2023

Researcher: Nguyen Anh Tien

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get

6.1

CVE-2023-33999

Jul 18, 2023

Researcher: Rafie Muhammad

Redirection for Contact Form 7 <= 2.7.0 - Authenticated(Editor+) Privilege Escalation

7.2

CVE-2023-23990

Feb 6, 2023

Researcher: Rafie Muhammad

Redirection for Contact Form 7 <= 2.4.0 - Missing Authorization

5.3

CVE-2021-36913

Sep 29, 2022

Researcher: mirphak

Redirection for Contact Form 7 <= 2.4.0 - Reflected Cross-Site Scripting

6.1

CVE-2022-0250

Mar 7, 2022

Researcher: ZhongFu Su

Freemius SDK <= 2.4.2 - Missing Authorization Checks

6.3

CVE ID Unknown

Mar 4, 2022

Researchers:

Redirection for Contact Form 7 <= 2.3.3 - Authenticated Arbitrary Plugin Installation

6.5

CVE-2021-24279

Apr 20, 2021

Researcher: Chloe Chamberland

Redirection for Contact Form 7 <= 2.3.3 - Unauthenticated Arbitrary Nonce Generation

7.5

CVE-2021-24278

Apr 20, 2021

Researcher: Chloe Chamberland

Redirection for Contact Form 7 <= 2.3.3 - Authenticated PHP Object Injection

8.8

CVE-2021-24280

Apr 20, 2021

Researcher: Chloe Chamberland

Redirection for Contact Form 7 <= 2.3.3 - Unprotected AJAX Actions

6.3

CVE-2021-24282

Apr 20, 2021

Researcher: Chloe Chamberland

Redirection for Contact Form 7 <= 2.3.3 - Authenticated Arbitrary Post Deletion

4.3

CVE-2021-24281

Apr 20, 2021

Researcher: Chloe Chamberland

Title	Status	CVE ID	CVSS	Researchers	Date
Redirection for Contact Form 7 <= 2.9.2 - Missing Authorization	Patched	CVE-2023-39920	5.3	Nguyen Anh Tien	October 3, 2023
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get	Patched	CVE-2023-33999	6.1	Rafie Muhammad	July 18, 2023
Redirection for Contact Form 7 <= 2.7.0 - Authenticated(Editor+) Privilege Escalation	Patched	CVE-2023-23990	7.2	Rafie Muhammad	February 6, 2023
Redirection for Contact Form 7 <= 2.4.0 - Missing Authorization	Patched	CVE-2021-36913	5.3	mirphak	September 29, 2022
Redirection for Contact Form 7 <= 2.4.0 - Reflected Cross-Site Scripting	Patched	CVE-2022-0250	6.1	ZhongFu Su	March 7, 2022
Freemius SDK <= 2.4.2 - Missing Authorization Checks	Patched		6.3		March 4, 2022
Redirection for Contact Form 7 <= 2.3.3 - Authenticated Arbitrary Plugin Installation	Patched	CVE-2021-24279	6.5	Chloe Chamberland	April 20, 2021
Redirection for Contact Form 7 <= 2.3.3 - Unauthenticated Arbitrary Nonce Generation	Patched	CVE-2021-24278	7.5	Chloe Chamberland	April 20, 2021
Redirection for Contact Form 7 <= 2.3.3 - Authenticated PHP Object Injection	Patched	CVE-2021-24280	8.8	Chloe Chamberland	April 20, 2021
Redirection for Contact Form 7 <= 2.3.3 - Unprotected AJAX Actions	Patched	CVE-2021-24282	6.3	Chloe Chamberland	April 20, 2021
Redirection for Contact Form 7 <= 2.3.3 - Authenticated Arbitrary Post Deletion	Patched	CVE-2021-24281	4.3	Chloe Chamberland	April 20, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.