CVE-2026-120659

Name of the Vulnerable Software and Affected Versions Redirection for Contact Form 7 versions prior to 3.2.15

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. This issue can be exploited if a published Contact Form 7 form is configured with the Save Entry (Save Lead) action enabled.

Recommendations Update to version 3.2.15 or later.