CVE-2025-8145: Themeisle Redirection For Contact Form 7

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the get_lead_fields function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in a Contact Form 7 plugin allows attackers to delete arbitrary files. Additionally, in certain server configurations, Remote Code Execution is possible

Affected products

• Themeisle Redirection For Contact Form 7: up to and including 3.2.4

Published 2025-08-20. Last modified 2026-06-17.