The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.2.4. This vulnerability allows unauthenticated attackers to inject a PHP Object through deserialization of untrusted input in the get_lead_fields function. Additionally, the presence of a POP chain can enable attackers to delete arbitrary files and, in certain server configurations, achieve Remote Code Execution.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-8145 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted input to the get_lead_fields function of the plugin, which can lead to PHP Object Injection. This can allow the attacker to manipulate the application and potentially execute arbitrary code or delete files on the server, especially if the server is misconfigured.
Affected Products
- Redirection for Contact Form 7 plugin (versions up to 3.2.4): Vulnerable to PHP Object Injection and potential Remote Code Execution.
Mitigation
It is recommended to update the Redirection for Contact Form 7 plugin to the latest version to mitigate this vulnerability. Additionally, ensure that server configurations are secure to prevent unauthorized access and code execution.