The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.2.4. This vulnerability allows unauthenticated attackers to inject a PHP Object through the deserialization of untrusted input in the delete_associated_files function. It requires the ‘Redirection For Contact Form 7 Extension – Create Post’ extension to be activated and can lead to arbitrary file deletion if a vulnerable plugin or theme is also present.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-8289 |
Exploitation
To exploit this vulnerability, an attacker must have access to a site that has the Redirection for Contact Form 7 plugin and the ‘Redirection For Contact Form 7 Extension – Create Post’ extension enabled. By submitting a form with a file upload action, the attacker can trigger the deserialization of untrusted input, potentially leading to arbitrary file deletion or other malicious actions if a vulnerable plugin or theme is present.
Affected Products
- Redirection for Contact Form 7 Plugin: A WordPress plugin that allows redirection of form submissions, vulnerable to PHP Object Injection.
- Contact Form 7: A required plugin for the Redirection for Contact Form 7, which can be exploited in conjunction with the vulnerable extension.
Mitigation
To mitigate this vulnerability, it is recommended to update the Redirection for Contact Form 7 plugin to the latest version and ensure that the ‘Redirection For Contact Form 7 Extension – Create Post’ extension is not activated if not needed. Additionally, review and remove any other plugins or themes that may contain a PHP Object Injection chain.