Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection

The core of the vulnerability lies in the getleadfields function, which fails to properly sanitize deserialized input. An attacker can craft a malicious payload containing a PHP Object that, when deserialized, executes arbitrary code. The presence of a known PHP Object Injection (POI) chain within a Contact Form 7 plugin amplifies the risk, enabling attackers to delete files on the server. In environments where the webserver user has write access to sensitive files (e.g., configuration files, core WordPress files), this file deletion can be a precursor to more significant compromise. The potential for RCE, while dependent on server configuration, represents the most severe impact, allowing attackers to gain complete control over the affected WordPress instance.

WordPress websites utilizing the Redirection for Contact Form 7 plugin, particularly those with older versions (0.0.0–3.2.4), are at significant risk. Shared hosting environments where the webserver user has elevated privileges are especially vulnerable, as file deletion could lead to broader system compromise. Websites with misconfigured file permissions are also at increased risk.

• wordpress / composer / npm:

grep -r 'unserialize($_REQUEST[')' . ')' . ';' plugins/redirection/includes/class-redirection.php

• wordpress / composer / npm:

wp plugin list --status=inactive | grep redirection

• wordpress / composer / npm:

wp plugin update --all

• generic web: Check WordPress plugin directory for reports of exploitation or malicious plugin versions. • generic web: Review server access logs for unusual requests containing serialized data.

1. 2025-08-20Disclosure

   disclosure

2. 2025-08-20Patch

   patch

1. आरक्षित2025-07-24
2. प्रकाशित2025-08-20
3. संशोधित2026-04-08
4. EPSS अद्यतन2026-03-23

The primary mitigation is to immediately upgrade the Redirection for Contact Form 7 plugin to version 3.2.5 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. Web Application Firewalls (WAFs) configured to detect and block deserialization attacks can provide an additional layer of defense. Specifically, look for WAF rules that identify patterns associated with PHP Object Injection. Review and restrict file permissions for the webserver user to minimize the impact of potential file deletion. Monitor WordPress logs for suspicious activity, particularly deserialization errors or attempts to access sensitive files.

सक्रिय इंस्टॉलेशन

200Kज्ञात

प्लगइन रेटिंग