Login Request a demo
High severity · published Aug 20, 2025
CVE-2025-8141
Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated Arbitrary File Deletion
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_associated_files function in all versions up to, and including, 3.2.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Redirection for Contact Form 7 · themeisle
through 3.2.4 · source: vendor
Affected product
RF
Redirection for Contact Form 7
themeisle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8141
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8141
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.3/classes/class-wpcf7r-save-files.php#L80
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/fafd0159-25ab-430d-88ef-c4d09d23baa7?source=cve
More from Redirection for Contact Form 7
8.8
CVE-2025-8145
Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection
8.1
CVE-2025-14800
Redirection for Contact Form 7 <= 3.2.7 - Unauthenticated Arbitrary File Copy via move_file_to_upload
7.5
CVE-2025-8289
Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization
7.5
CVE-2023-39920
WordPress Redirection for Contact Form 7 plugin <= 2.9.2 - Broken Access Control vulnerability
7.1
CVE-2026-23970
WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability