CVE-2026-80439 Overview
CVE-2026-80439 affects the Redirection for Contact Form 7 WordPress plugin from version 2.2.7 before 3.2.11. The plugin fails to prevent shortcodes submitted through form values from being executed. When the plugin substitutes user-submitted values into an action's settings, it then processes those settings for shortcodes. Unauthenticated attackers can submit crafted form values to execute any shortcode registered on the target site and read its output. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).
Critical Impact
Unauthenticated attackers can execute arbitrary registered shortcodes and read their output through Contact Form 7 submissions on vulnerable sites.
Affected Products
- Redirection for Contact Form 7 WordPress plugin, versions 2.2.7 through 3.2.10
- WordPress sites using Contact Form 7 with the vulnerable Redirection add-on
- Any site with additional plugins that register shortcodes exposing sensitive data
Discovery Timeline
- 2026-09-06 - CVE-2026-80439 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-80439
Vulnerability Analysis
The Redirection for Contact Form 7 plugin extends Contact Form 7 with post-submission action routing. During submission processing, the plugin substitutes user-supplied form field values into action configuration templates. Those configured settings are then passed through WordPress's do_shortcode() function during evaluation.
Because the substitution happens before shortcode processing, any shortcode syntax placed inside a form field is preserved and later interpreted. An unauthenticated user submitting a public contact form can therefore trigger the execution of any shortcode registered on the site. The impact depends on which shortcodes are available. Shortcodes that expose user data, session details, or plugin internals can leak sensitive information back to the attacker.
Root Cause
The root cause is improper neutralization of shortcode delimiters in user-controlled input before that input reaches a shortcode-processing context. The plugin treats submitted values as trusted template data and passes them through the WordPress shortcode parser without escaping brackets or restricting the shortcode set that may execute.
Attack Vector
Exploitation requires only network access to a public form served by the vulnerable plugin. The attacker submits a form field value containing shortcode syntax such as bracketed shortcode tags with attributes. When the plugin processes the redirect or action configuration, the shortcode is executed under the plugin's context. Attack complexity is elevated because a useful shortcode must be registered on the target site and its output must reach the attacker through the response, email notification, or logged submission.
See the WPScan Vulnerability Report for technical details on the affected code paths.
Detection Methods for CVE-2026-80439
Indicators of Compromise
- Contact Form 7 submissions containing bracketed shortcode syntax such as [shortcode_name] in unexpected fields like name, subject, or message.
- Email notifications or admin logs containing rendered shortcode output instead of literal user text.
- Unusual queries to plugin- or theme-registered shortcodes correlated with form submission timestamps.
Detection Strategies
- Inspect stored Contact Form 7 submission logs for square-bracket patterns matching any registered shortcode names on the site.
- Review web server access logs for POST requests to wp-admin/admin-ajax.php with action=wpcf7_submit where request bodies contain shortcode delimiters.
- Compare outbound notification email bodies against the raw submitted values to identify server-side shortcode expansion.
Monitoring Recommendations
- Enable verbose logging on Contact Form 7 and the Redirection add-on to capture pre- and post-processing form data.
- Alert on form submissions where any field value contains [ and ] characters wrapping known shortcode tags.
- Monitor plugin, theme, and site versions against the fixed release 3.2.11 to identify unpatched instances.
How to Mitigate CVE-2026-80439
Immediate Actions Required
- Update the Redirection for Contact Form 7 plugin to version 3.2.11 or later on every WordPress instance.
- Audit installed plugins for shortcodes that expose sensitive data such as user metadata, secret keys, or database contents.
- Review recent form submissions for shortcode injection attempts and evaluate whether any output was disclosed.
Patch Information
The vendor addressed the issue in Redirection for Contact Form 7 version 3.2.11. The fix prevents user-submitted values from being treated as shortcode input during action settings processing. Refer to the WPScan Vulnerability Report for advisory details and version metadata.
Workarounds
- Temporarily deactivate the Redirection for Contact Form 7 plugin until the update is applied.
- Add server-side input filtering that strips [ and ] characters from Contact Form 7 field values before storage or processing.
- Restrict shortcode registration by removing or gating plugins that expose sensitive data through shortcodes.
# Update the plugin using WP-CLI
wp plugin update wpcf7-redirect --version=3.2.11
# Verify the installed version
wp plugin get wpcf7-redirect --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
