CVE-2026-121873

UNKNOWN 0.0

Redirection for Contact Form 7 2.6.0 - 3.2.15 - Unauthenticated Forged Personal Data Request Creation

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control.

Vendor	unknown
Product	redirection for contact form 7
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for unknown redirection for contact form 7

Be the first to know when new unknown vulnerabilities affecting unknown redirection for contact form 7 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Redirection for Contact Form 7

2.6.0 < 3.2.16

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/543fa273-943b-40f6-bcdf-84ca800fa46b/

Credits

Akshat Parikh (SN1PER) WPScan