CVE-2025-8145: Contact Form 7 Redirection RCE Vulnerability

CVE-2025-8145 Overview

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the get_lead_fields function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in a Contact Form 7 plugin allows attackers to delete arbitrary files. Additionally, in certain server configurations, Remote Code Execution is possible.

Critical Impact

Unauthenticated attackers can exploit this PHP Object Injection vulnerability to delete arbitrary files on the server. Under specific server configurations, this vulnerability can be leveraged for Remote Code Execution, potentially leading to complete site compromise.

Affected Products

• Redirection for Contact Form 7 plugin for WordPress versions up to and including 3.2.4
• WordPress installations with Contact Form 7 plugin containing exploitable POP chains
• Server configurations that enable Remote Code Execution through PHP Object Injection

Discovery Timeline

• 2025-08-20 - CVE-2025-8145 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-8145

Vulnerability Analysis

This vulnerability is classified as Insecure Deserialization (CWE-502), which occurs when applications deserialize untrusted data without proper validation. The get_lead_fields function in the Redirection for Contact Form 7 plugin processes user-supplied input through PHP's deserialization mechanism without adequate sanitization, allowing attackers to craft malicious serialized objects.

The attack does not require any authentication, making it particularly dangerous for WordPress sites running vulnerable versions of this plugin. When combined with existing Property-Oriented Programming (POP) chains present in the Contact Form 7 plugin ecosystem, attackers can chain method calls to achieve destructive outcomes including arbitrary file deletion and, under certain server configurations, Remote Code Execution.

Root Cause

The root cause of this vulnerability lies in the unsafe use of PHP's unserialize() function on untrusted user input within the get_lead_fields function located in class-wpcf7r-lead.php. The function fails to validate or sanitize the incoming data before deserializing it, allowing attackers to inject arbitrary PHP objects into the application's memory space.

When PHP deserializes a malicious payload, it can instantiate objects of any class loaded in the application and trigger magic methods such as __destruct(), __wakeup(), or __toString(). If a suitable POP chain exists—as is the case with Contact Form 7—these magic methods can be chained to perform dangerous operations like file manipulation or code execution.

Attack Vector

The attack is conducted over the network and requires some user interaction, though the attacker does not need any authentication or privileges on the target WordPress installation. An attacker crafts a specially designed serialized PHP object payload that exploits the deserialization process in the get_lead_fields function.

The attack flow typically follows these steps: First, the attacker identifies a target WordPress site running the vulnerable Redirection for Contact Form 7 plugin. Next, they craft a malicious serialized PHP object that leverages known POP chains in the Contact Form 7 plugin ecosystem. The payload is then submitted to the application through the vulnerable function, triggering deserialization and executing the malicious object chain. Depending on the payload and server configuration, this can result in arbitrary file deletion or Remote Code Execution.

For technical details on the vulnerable code, see the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-8145

Indicators of Compromise

• Presence of serialized PHP object strings (starting with O:, a:, or s:) in HTTP request parameters, POST data, or cookies targeting the Redirection for Contact Form 7 plugin
• Unexpected file deletions on the WordPress installation, particularly configuration files or critical plugin files
• Web server logs showing unusual POST requests to Contact Form 7 related endpoints with large or encoded payloads
• Evidence of unauthorized code execution or new PHP files appearing in the WordPress installation

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in incoming requests
• Monitor WordPress plugin directories for unexpected file modifications or deletions
• Enable detailed logging for the Redirection for Contact Form 7 plugin and review for suspicious deserialization activities
• Deploy runtime application self-protection (RASP) solutions capable of detecting PHP Object Injection attempts

Monitoring Recommendations

• Configure real-time file integrity monitoring for critical WordPress directories including wp-content/plugins/ and wp-config.php
• Set up alerting for unusual HTTP request patterns, particularly POST requests with serialized object signatures
• Monitor for signs of lateral movement or privilege escalation following any suspected exploitation attempt
• Review web server access logs for repeated attempts to access the vulnerable plugin endpoints

How to Mitigate CVE-2025-8145

Immediate Actions Required

• Update the Redirection for Contact Form 7 plugin to a version newer than 3.2.4 immediately
• If an update is not available, temporarily disable the Redirection for Contact Form 7 plugin until a patch is released
• Review WordPress file system for signs of unauthorized file deletion or modification
• Conduct a security audit of all installed WordPress plugins to identify other potential deserialization vulnerabilities

Patch Information

Site administrators should update the Redirection for Contact Form 7 plugin to the latest available version that addresses this PHP Object Injection vulnerability. Monitor the official WordPress plugin repository and the Wordfence Vulnerability Report for patch announcements and updated security guidance.

Workarounds

• Temporarily disable the Redirection for Contact Form 7 plugin if updates are not immediately available
• Implement WAF rules to block requests containing PHP serialized object patterns targeting the plugin
• Restrict access to the WordPress admin and plugin endpoints through IP whitelisting where feasible
• Enable PHP's disable_classes directive to prevent instantiation of dangerous classes used in known POP chains

# WordPress WAF configuration example for ModSecurity
# Block PHP serialized object injection attempts
SecRule ARGS|REQUEST_BODY "@rx (O|a|s):\d+:" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'Potential PHP Object Injection Detected',\
    tag:'CVE-2025-8145'"