High severity · published Aug 20, 2025
CVE-2025-8145
Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the get_lead_fields function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in a Contact Form 7 plugin allows attackers to delete arbitrary files. Additionally, in certain server configurations, Remote Code Execution is possible
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Redirection for Contact Form 7 · themeisle
through 3.2.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8145
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8145
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.3/classes/class-wpcf7r-lead.php#L144
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/2cb275d5-ec4b-419f-84e1-84172d381411?source=cve
More from Redirection for Contact Form 7
8.8
CVE-2025-8141
Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated Arbitrary File Deletion
8.1
CVE-2025-14800
Redirection for Contact Form 7 <= 3.2.7 - Unauthenticated Arbitrary File Copy via move_file_to_upload
7.5
CVE-2025-8289
Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization
7.5
CVE-2023-39920
WordPress Redirection for Contact Form 7 plugin <= 2.9.2 - Broken Access Control vulnerability
7.1
CVE-2026-23970
WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability