Platform
wordpress
Component
wpcf7-redirect
Fixed in
3.2.5
CVE-2025-8141 describes an arbitrary file access vulnerability affecting the Redirection for Contact Form 7 plugin for WordPress. This flaw allows unauthenticated attackers to delete files on the server, potentially leading to remote code execution. The vulnerability impacts versions 0.0.0 through 3.2.4 of the plugin, and a fix is available in version 3.2.5.
The primary impact of CVE-2025-8141 is the ability for an unauthenticated attacker to delete arbitrary files on a WordPress server. The vulnerability stems from insufficient file path validation within the deleteassociatedfiles function. While file deletion alone can disrupt website functionality, the most severe consequence arises when critical configuration files, such as wp-config.php, are targeted. Deletion of wp-config.php would effectively grant the attacker complete control over the WordPress installation, enabling remote code execution and data exfiltration. This vulnerability shares similarities with other file access vulnerabilities where improper validation allows for unauthorized modification or deletion of sensitive files, potentially leading to a complete compromise of the system.
CVE-2025-8141 was publicly disclosed on 2025-08-20. No public proof-of-concept (PoC) code has been released at the time of writing, but the ease of exploitation given the unauthenticated nature of the vulnerability suggests a moderate probability of exploitation. It is not currently listed on the CISA KEV catalog. Monitor security advisories and threat intelligence feeds for any indications of active exploitation campaigns targeting this vulnerability.
Exploit Status
EPSS
0.35% (57% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-8141 is to immediately upgrade the Redirection for Contact Form 7 plugin to version 3.2.5 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include restricting file access permissions on the server to limit the impact of a successful attack, or implementing a Web Application Firewall (WAF) rule to block requests targeting the vulnerable deleteassociatedfiles function. Thoroughly test any configuration changes in a staging environment before applying them to production. After upgrading, verify the fix by attempting to access the vulnerable endpoint with a non-authenticated user and confirming that file deletion is prevented.
Update the Redirection for Contact Form 7 plugin to version 3.2.5 or higher to address the arbitrary file deletion vulnerability. This update corrects the inadequate file path validation, preventing unauthenticated attackers from deleting sensitive files on the server.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-8141 is a HIGH severity vulnerability in the Redirection for Contact Form 7 WordPress plugin allowing unauthenticated attackers to delete files, potentially leading to remote code execution.
You are affected if your WordPress site uses Redirection for Contact Form 7 version 0.0.0 through 3.2.4. Upgrade immediately.
Upgrade the Redirection for Contact Form 7 plugin to version 3.2.5 or later. If immediate upgrade is not possible, implement temporary workarounds like WAF rules or restricted file permissions.
While no public exploits are currently known, the ease of exploitation suggests a potential for active exploitation. Monitor security advisories.
Refer to the official Redirection for Contact Form 7 plugin website and WordPress security announcements for the latest advisory and updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.