The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_associated_files function in all versions up to, and including, 3.2.4. This vulnerability allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution if critical files like wp-config.php are deleted.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-8141 |
Exploitation
To exploit this vulnerability, an attacker can send a specially crafted request to the server to invoke the delete_associated_files function without authentication. By manipulating the file path, the attacker can target sensitive files for deletion, which may lead to further exploitation such as remote code execution.
Affected Products
- Redirection for Contact Form 7 plugin (versions up to 3.2.4): This plugin allows users to manage redirections for their contact forms but is vulnerable to file deletion attacks.
Mitigation
To mitigate this vulnerability, users should update the Redirection for Contact Form 7 plugin to the latest version immediately. Additionally, implementing proper file path validation and restricting file deletion permissions can help prevent unauthorized access.