CVE-2025-14800: falha de alta gravidade em themeisle Redirection for Contact Form 7
Redirection for Contact Form 7 <= 3.2.7 - Unauthenticated Arbitrary File Copy via move_file_to_upload
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.4%
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload' function in all versions up to, and including, 3.2.7. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site's server. If 'allow_url_fopen' is set to 'On', it is possible to upload a remote file to the server.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
themeisle · Redirection for Contact Form 7CVEs relacionadas — themeisle Redirection for Contact Form 7
No mesmo produto, das mais perigosas para as menos.
CVE-2025-8141HIGHRedirection for Contact Form 7 <= 3.2.4 - Unauthenticated Arbitrary File DeletionEPSS 0.6%CVE-2025-8145HIGHRedirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object InjectionEPSS 0.5%CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2026-120659MEDIUMRedirection for Contact Form 7 <= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' ParameterEPSS 0.4%CVE-2025-8289HIGHRedirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection via PHAR DeserializationEPSS 0.4%CVE-2025-9562MEDIUMRedirection for Contact Form 7 <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date ShortcodeEPSS 0.3%