The Redirection for Contact Form 7 WordPress plugin fails to guard against shortcode execution when user-supplied form data is substituted into action settings. Unauthenticated users can submit any arbitrary value that contains a shortcode, leading the plugin to process that shortcode and return its output, effectively executing any server-side code registered as a shortcode on the site. This flaw permits code theft, data exfiltration, or other malicious activity, compromising confidentiality and availability of the site.

The vulnerability affects the Redirection for Contact Form 7 plugin for WordPress, specifically versions 2.2.7 through 3.2.10 inclusive. All installations running these versions are exposed until patched to 3.2.11 or newer.

The CVSS score of 4.8 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation to date. Attackers can trigger the flaw by crafting a form submission containing a malicious shortcode, which any unauthenticated user can do. The lack of authentication checks in the form handling creates a low barrier to exploitation, but the actual impact relies on the availability of executable shortcodes on the target site.