The Redirection for Contact Form 7 plugin is vulnerable to PHP Object Injection through deserialization of untrusted input in the get_lead_fields function. An unauthenticated attacker can inject arbitrary PHP objects, which when processed in conjunction with a known POP chain in Contact Form 7 can lead to deletion of arbitrary files. In certain server configurations, the injected payload can also be used to achieve remote code execution.

The vulnerable component is the Redirection for Contact Form 7 WordPress plugin developed by ThemeIsle. Versions up to and including 3.2.4 are affected. The plugin is commonly installed on WordPress sites that use Contact Form 7.

The CVSS score is 8.8, indicating a high severity. The EPSS score of 2% suggests a non‑negligible likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is most likely through data submitted to a public contact form, which is unauthenticated. Exploitation requires that the site runs an affected version of the plugin and has the default configuration that allows PHP object deserialization; if the server also processes the POP chain, the attacker may delete files or execute code.