CVE-2025-13146 Overview
CVE-2025-13146 affects the Contact Form 7 – Dynamic Text Extension plugin for WordPress. The plugin passes user-supplied input to do_shortcode without proper validation, allowing unauthenticated attackers to execute arbitrary WordPress shortcodes. All versions up to and including 5.0.6 are affected, with a partial patch delivered in version 5.0.4. The flaw is classified under [CWE-94] Improper Control of Generation of Code and is exploitable over the network without authentication or user interaction.
Critical Impact
Unauthenticated attackers can trigger arbitrary shortcode execution against vulnerable WordPress sites, enabling information disclosure and abuse of shortcode-driven functionality provided by other installed plugins.
Affected Products
- Contact Form 7 – Dynamic Text Extension plugin for WordPress (all versions ≤ 5.0.6)
- WordPress sites with the plugin enabled and public-facing forms
- Environments where additional shortcode-providing plugins expand the attack surface
Discovery Timeline
- 2026-07-22 - CVE-2025-13146 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2025-13146
Vulnerability Analysis
The Dynamic Text Extension enriches Contact Form 7 fields with values derived at runtime. During this processing, the plugin invokes WordPress's do_shortcode function on values that originate from user-controlled input. Because the input passes through insufficient validation, an unauthenticated attacker can supply a crafted shortcode string that the plugin evaluates server-side.
WordPress shortcodes are registered by core, themes, and third-party plugins. Once evaluation occurs, the attacker inherits the capabilities of every shortcode installed on the target site. This can lead to disclosure of restricted content, invocation of privileged callbacks, or manipulation of features that shortcodes expose to templates. The impact scales with the shortcode ecosystem present on the target.
Version 5.0.4 introduced a partial patch that did not fully close the injection path. Versions through 5.0.6 remain exploitable, requiring an upgrade to the fixed release referenced in WordPress Changeset #3430784.
Root Cause
The root cause is unsafe use of do_shortcode on unvalidated input inside the plugin's dynamic value pipeline. Relevant code paths are documented at contact-form-7-dynamic-text-extension.php line 765, line 782, and utilities.php line 265. These handlers accept values that were meant to represent dynamic form defaults, then hand them to the shortcode parser instead of treating them as opaque text.
Attack Vector
Exploitation occurs over HTTP against any page containing a vulnerable Contact Form 7 form. An attacker crafts a request that places a shortcode payload where the plugin resolves a dynamic value. When the plugin renders or processes the form, WordPress executes the shortcode with the site's own permissions. No authentication, credentials, or user interaction are required. Additional technical context is available in the Wordfence Vulnerability Analysis.
Detection Methods for CVE-2025-13146
Indicators of Compromise
- HTTP requests to pages containing Contact Form 7 forms with parameters containing bracketed shortcode syntax such as [shortcode_name ...]
- Access log entries with unusual query parameters targeting dynamichidden, dynamictext, or related field names introduced by the plugin
- Unexpected shortcode output in form responses, cached pages, or email notifications generated by Contact Form 7
Detection Strategies
- Inventory WordPress deployments and flag installations of Contact Form 7 – Dynamic Text Extension at version 5.0.6 or earlier
- Inspect web server and WAF logs for shortcode brackets in GET or POST parameters submitted to endpoints that render forms
- Correlate spikes in form submission volume with anomalous outbound requests originating from the WordPress host
Monitoring Recommendations
- Enable verbose logging on the WordPress host and forward access logs to a centralized analytics platform for shortcode pattern searches
- Alert on modifications to plugin files under wp-content/plugins/contact-form-7-dynamic-text-extension/
- Monitor for new administrative users, scheduled tasks, or option changes following suspicious form interactions
How to Mitigate CVE-2025-13146
Immediate Actions Required
- Update the Contact Form 7 – Dynamic Text Extension plugin to the fixed release published in WordPress Changeset #3430784
- If patching is not immediately possible, deactivate and remove the plugin from vulnerable sites
- Audit forms for suspicious dynamic field configurations and review recent form submissions for shortcode payloads
Patch Information
The partial fix landed in version 5.0.4 and did not fully remediate the issue. Administrators must install the release that supersedes 5.0.6, which fully sanitizes values before they reach do_shortcode. Verify the installed version through the WordPress admin plugins page after updating.
Workarounds
- Restrict access to pages hosting Contact Form 7 forms using a web application firewall rule that blocks shortcode syntax in request parameters
- Disable dynamic field types provided by the plugin until the patched version is deployed
- Remove or disable non-essential shortcode-providing plugins to reduce the impact of any residual exploitation
# Example WP-CLI command to update the vulnerable plugin
wp plugin update contact-form-7-dynamic-text-extension
wp plugin get contact-form-7-dynamic-text-extension --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
