The Redirection for Contact Form 7 WordPress plugin (v2.2.7 to v3.2.10) fails to block shortcode execution when user‑supplied form fields are interpolated into an action’s configuration. In effect, any unauthenticated visitor can submit a form containing a malicious shortcode, which the plugin then processes and returns the shortcode’s output. Because shortcodes are PHP callbacks registered by the site, this flaw permits the attacker to run arbitrary server‑side code, read data, and potentially exfiltrate information.

The vulnerability impacts any WordPress site that has the Redirection for Contact Form 7 plugin installed in a version prior to 3.2.11. This includes the full version range 2.2.7 through 3.2.10 inclusive. If the plugin is active and forms are accessible, the site is exposed.

The CVSS score of 4.8 indicates moderate risk. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation. The attack vector is likely a low‑effort POST request to a form endpoint; authentication is not required, and the only prerequisite is the presence of an executable shortcode. While successful exploitation depends on the site’s shortcode architecture, the unauthenticated nature and simplicity of the payload make it a credible threat.