CVE-2025-14800: Themeisle Redirection For Contact Form 7

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload' function in all versions up to, and including, 3.2.7. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site's server. If 'allow_url_fopen' is set to 'On', it is possible to upload a remote file to the server.

Affected products

• Themeisle Redirection For Contact Form 7: up to and including 3.2.7

Published 2025-12-21. Last modified 2026-09-28.