CVE-2026-11395

Name of the Vulnerable Software and Affected Versions CF7 to Webhook versions prior to 5.0.1

Description The CF7 to Webhook plugin for WordPress is subject to Server-Side Request Forgery (SSRF), a flaw where an attacker can induce the server-side application to make requests to an unintended location. This occurs via the pull the trigger function. Unauthenticated attackers can make web requests to arbitrary locations from the web application to query or modify information from internal services. Exploitation is possible if the admin-configured webhook URL contains a Contact Form 7 field placeholder in the host segment of the URL and the affected form is publicly accessible.

Recommendations Update the plugin to a version later than 5.0.0.