CVE-2026-80439: 
WordPress vulnerability analysis and mitigation

CVE-2026-80439 is an unauthenticated arbitrary shortcode execution vulnerability in the Redirection for Contact Form 7 WordPress plugin. The flaw affects versions 2.2.7 through 3.2.10 and allows unauthenticated attackers to execute any shortcode registered on the site by injecting shortcode syntax into submitted form field values. It was publicly disclosed on September 3, 2026, with a CVE record published on September 6, 2026. The vulnerability carries a CVSS v3.1 base score of 4.8 (Medium), assigned by WPScan (WPScan, GitHub Advisory).

The root cause is improper neutralization of special elements in output used by a downstream component (CWE-74). When the plugin processes an action's settings after a form submission, it substitutes submitted form field values (mail-tags) directly into those settings and then evaluates the resulting string for WordPress shortcodes — without first stripping or escaping any shortcode syntax present in the user-supplied input. This two-step substitution-then-evaluation pattern means an attacker can embed a shortcode (e.g., [some_shortcode]) in a form field value, which will be executed server-side when the plugin processes the action. Exploitation requires that the site administrator has configured at least one action setting to include a form field placeholder, which is the standard documented usage of the plugin (WPScan, GitHub Advisory).

A successful exploit allows an unauthenticated remote attacker to execute any WordPress shortcode registered on the target site and read its output. Depending on which shortcodes are registered, this could expose sensitive site data, trigger privileged plugin functionality, or leak configuration information — resulting in low confidentiality and low integrity impact with no direct availability impact. The practical severity is highly dependent on the shortcodes available on the specific WordPress installation (WPScan, GitHub Advisory).

No public proof-of-concept exploit code is currently available; WPScan indicated a PoC would be published on September 17, 2026, to allow time for users to update. There is no evidence of in-the-wild exploitation at this time, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.233% (14th percentile), reflecting a low near-term exploitation probability. Exploitation requires high attack complexity due to the precondition that an administrator must have configured a form field placeholder in an action setting (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the wpcf7-redirect (Redirection for Contact Form 7) plugin at versions 2.2.7–3.2.10 using tools like WPScan or by inspecting plugin asset paths in page source.
2. Identify configured forms: Locate Contact Form 7 forms on the target site that have the Redirection plugin's action configured with a form field placeholder (mail-tag) in one of its settings fields — this is the standard plugin usage.
3. Craft malicious form submission: Submit the contact form with a shortcode payload (e.g., [shortcode_name] or [shortcode_name attribute="value"]) as the value of the form field that is referenced by the action's setting.
4. Trigger shortcode execution: Upon form submission, the plugin substitutes the attacker-controlled value into the action setting and then processes the setting for shortcodes, causing the injected shortcode to execute server-side.
5. Read output: Depending on the plugin's action configuration (e.g., redirect URL, email body), the shortcode output may be reflected in the HTTP response, an email, or a redirect destination, allowing the attacker to read the result (WPScan).

• Network: Unusual or repeated POST requests to Contact Form 7 form endpoints (/?page_id=... or /contact/) containing shortcode syntax (e.g., [shortcode_name]) in form field parameters.
• Logs: WordPress access logs showing form submissions with values matching the pattern \[.*\] in fields that correspond to mail-tag placeholders configured in Redirection for CF7 actions.
• Application Behavior: Unexpected shortcode output appearing in redirect URLs, confirmation emails, or server responses following form submissions from unauthenticated users.

The vendor has released a patched version: Redirection for Contact Form 7 3.2.11, which prevents shortcode execution from user-submitted form values. Site administrators should update the plugin to version 3.2.11 or later immediately via the WordPress admin dashboard or WP-CLI (wp plugin update wpcf7-redirect). As a temporary workaround, administrators can review and remove form field placeholders from action settings that are not strictly necessary, or disable the plugin until an update can be applied (WPScan, GitHub Advisory).

The vulnerability was discovered and reported by independent researcher Jakub Herman, who submitted it to WPScan. WPScan verified the issue and coordinated disclosure, delaying PoC publication until September 17, 2026, to provide a remediation window for site operators. No significant broader media coverage or notable social media discussion has been identified at this time (WPScan).