Description
Server-Side Request Forgery (SSRF) vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Server Side Request Forgery.This issue affects Extensions For CF7: from n/a through <= 3.2.0.
Published: 2025-01-24
Score: 4.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a server‑side request forgery in the HT Plugins "Extensions For CF7" WordPress plugin. An attacker can cause the server to issue HTTP requests to arbitrary URLs. The flaw is identified as CWE‑918 and could enable the attacker to reach internal or external services that the site is able to access.

Affected Systems

WordPress sites that have installed the "Extensions For CF7" plugin version 3.2.0 or earlier. The affected component is listed under HT Plugins and identified as an Extensions For CF7 plugin within WordPress. Sites that rely on this plugin for contact form handling are susceptible.

Risk and Exploitability

The CVSS score of 4.4 indicates a medium severity vulnerability. The EPSS score is below 1%, indicating a low probability that the flaw is currently being actively exploited. The issue is not listed in the CISA KEV catalog. The flaw requires the attacker to trigger a plugin function via a web request, which is the likely access path.

Generated by OpenCVE AI on May 2, 2026 at 09:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Extensions For CF7 to a version newer than 3.2.0 so the SSRF bug is fixed by the vendor.
  • If an immediate upgrade is not possible, uninstall or deactivate the plugin until a fixed version is released.
  • Add outbound filtering rules or a web‑application firewall rule to block unexpected external requests originating from WordPress, limiting the impact if the plugin is exploited.

Generated by OpenCVE AI on May 2, 2026 at 09:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-3887 Server-Side Request Forgery (SSRF) vulnerability in HasThemes Extensions For CF7 allows Server Side Request Forgery. This issue affects Extensions For CF7: from n/a through 3.2.0.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Server-Side Request Forgery (SSRF) vulnerability in HasThemes Extensions For CF7 allows Server Side Request Forgery. This issue affects Extensions For CF7: from n/a through 3.2.0. Server-Side Request Forgery (SSRF) vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Server Side Request Forgery.This issue affects Extensions For CF7: from n/a through <= 3.2.0.
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N'}

Fri, 23 Jan 2026 20:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:hasthemes:extensions_for_cf7:*:*:*:*:*:wordpress:*:*

Wed, 12 Feb 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 24 Jan 2025 17:30:00 +0000

Type Values Removed Values Added
Description Server-Side Request Forgery (SSRF) vulnerability in HasThemes Extensions For CF7 allows Server Side Request Forgery. This issue affects Extensions For CF7: from n/a through 3.2.0.
Title WordPress Extensions For CF7 Plugin <= 3.2.0 - Server Side Request Forgery (SSRF) vulnerability
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Hasthemes Extensions For Cf7
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-05-11T23:16:47.307Z

Reserved: 2025-01-23T14:52:23.104Z

Link: CVE-2025-24695

cve-icon Vulnrichment

Updated: 2025-02-12T19:55:31.682Z

cve-icon NVD

Status : Modified

Published: 2025-01-24T18:15:42.740

Modified: 2026-04-23T15:25:18.733

Link: CVE-2025-24695

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-02T09:45:36Z

Weaknesses