The Redirection for Contact Form 7 plugin for WordPress contains a PHP Object Injection vulnerability in all releases up to 3.2.4. The flaw resides in the delete_associated_files function where untrusted input is deserialized, allowing an unauthenticated attacker to inject a PHP object via PHAR deserialization. If successfully exploited, the attacker can delete arbitrary files, retrieve sensitive data, or potentially execute code, though code execution is possible only when a Point‑Off‑Protect chain exists in another plugin or theme installed on the same site.

The affected software is the Redirection for Contact Form 7 plugin by themeisle, versions up to and including 3.2.4. The vulnerability can be exercised only when the "Redirection For Contact Form 7 Extension – Create Post" add‑on is also installed and activated, and when a Contact Form 7 form with a file‑upload action is present on the site. Sites running PHP version greater than 8 are not impacted by this flaw.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of reporting. The flaw is not currently listed in the CISA KEV catalog. The likely attack vector is via the web form, meaning an unauthenticated remote attacker could submit crafted data to trigger the deserialization. Because the vulnerability alone permits only file deletion, the overall risk remains moderate, but the presence of any POP chain in installed plugins or themes can elevate the threat to arbitrary code execution.