CVE-2026-13425: Database for CF7 Plugin XSS Vulnerability

CVE-2026-13425 Overview

CVE-2026-13425 is a stored Cross-Site Scripting (XSS) vulnerability in the Database for CF7 plugin for WordPress. The flaw affects all versions up to and including 1.2.6. The plugin fails to sanitize input or escape output when processing array-structured values submitted through Contact Form 7 fields. Unauthenticated attackers can submit crafted payloads to the public REST API endpoint /wp-json/contact-form-7/v1/contact-forms/{id}/feedback. Injected scripts execute whenever an administrator or user views the affected page. The weakness is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can persistently inject arbitrary JavaScript that executes in the browser context of any user rendering a stored submission, enabling session theft, admin account takeover, and administrative action forgery.

Affected Products

Database for CF7 plugin for WordPress — all versions through 1.2.6
WordPress sites running Contact Form 7 with the Database for CF7 add-on
Any site exposing the /wp-json/contact-form-7/v1/contact-forms/{id}/feedback REST endpoint

Discovery Timeline

2026-07-29 - CVE-2026-13425 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-13425

Vulnerability Analysis

The Database for CF7 plugin persists Contact Form 7 submissions into a custom wp_cf7db table. Storage occurs through direct $wpdbINSERT calls, with array payloads passed through PHP serialize() before being written. This code path bypasses the WordPress save-time filtering normally applied by wp_insert_post and wp_kses. Because Contact Form 7 accepts array-structured input for standard text fields — for example, a field named your-name[] — attackers can deliver script payloads inside an array element that the plugin never sanitizes. When an administrator views the stored submission in the plugin's dashboard, the payload is rendered without output escaping and executes in the browser. See the Wordfence Vulnerability Report for the disclosure details.

Root Cause

The plugin trusts Contact Form 7 submission data at storage time and does not apply sanitization to array-structured field values. The storage function serializes arrays with serialize() and writes them directly via $wpdb. Reference the vulnerable code paths at database-for-cf7.php line 118 and database-for-cf7.php line 236. No output escaping is applied when values are later rendered in the administrative interface.

Attack Vector

An unauthenticated attacker crafts a POST request to the public REST endpoint /wp-json/contact-form-7/v1/contact-forms/{id}/feedback. The attacker submits a text field as an array — for example your-name[]=<script>...</script> — instead of a scalar. The plugin serializes and stores the payload without filtering. When a privileged user opens the submissions dashboard, the browser executes the injected script under the site's origin.

No verified public exploit code is available. Technical details are described in the linked plugin source and the Wordfence advisory.

Detection Methods for CVE-2026-13425

Indicators of Compromise

POST requests to /wp-json/contact-form-7/v1/contact-forms/{id}/feedback where standard text fields (your-name, your-email, your-subject) are submitted with [] suffixes indicating array structure.
Rows in the wp_cf7db table containing PHP-serialized array values (a:1:{i:0;s:...}) with HTML tags such as <script>, <img onerror=, or <svg onload= inside the string element.
Outbound requests from administrator browsers to unfamiliar domains shortly after opening the plugin's submissions view.

Detection Strategies

Query the wp_cf7db table for serialized values containing script tags or common XSS sinks (onerror, onload, javascript:).
Inspect web server access logs for REST feedback endpoint requests with array-notation parameters from unauthenticated sources.
Compare Contact Form 7 form definitions to submitted field types — array submissions for scalar fields are anomalous.

Monitoring Recommendations

Alert on new administrator sessions or privilege changes following views of the CF7 submissions dashboard.
Monitor for unusual JavaScript execution or DOM changes in the WordPress admin panel using Content Security Policy (CSP) violation reports.
Track HTTP request rates against the /wp-json/contact-form-7/v1/ namespace to identify abuse patterns.

How to Mitigate CVE-2026-13425

Immediate Actions Required

Update the Database for CF7 plugin to a version above 1.2.6 once released by the maintainer.
Audit the wp_cf7db table for existing serialized payloads containing HTML or script markup and purge malicious rows.
Rotate credentials and session tokens for any administrator who accessed the submissions dashboard while the plugin was vulnerable.

Patch Information

A fixed release addressing CVE-2026-13425 must sanitize array-structured field values before serialization and apply output escaping when rendering stored submissions. Consult the Wordfence Vulnerability Report and the plugin repository for the current status of a vendor patch.

Workarounds

Deactivate the Database for CF7 plugin until a patched version is available; Contact Form 7 will continue to function without local database storage.
Deploy a Web Application Firewall (WAF) rule to block POST requests to /wp-json/contact-form-7/v1/contact-forms/*/feedback where standard scalar fields are submitted with array notation.
Enforce a strict Content Security Policy on the WordPress admin interface to limit inline script execution when reviewing form submissions.
Restrict access to the WordPress admin dashboard to authenticated IP ranges to reduce the exposure window for privileged users.

bash

# Example WAF rule (ModSecurity) blocking array-notation abuse on CF7 REST endpoint
SecRule REQUEST_URI "@rx /wp-json/contact-form-7/v1/contact-forms/[0-9]+/feedback" \
  "chain,phase:2,deny,status:403,id:1026134251,msg:'CVE-2026-13425 CF7 array field abuse'"
  SecRule ARGS_NAMES "@rx (your-name|your-email|your-subject)\[\]" \
    "t:none"