CVE-2025-8289

Deeper analysis

The Redirection for Contact Form 7 plugin for WordPress is affected by a PHP Object Injection vulnerability in all versions through 3.2.4. The flaw stems from unsafe deserialization of untrusted input inside the delete_associated_files function, allowing an attacker to supply a serialized PHP object. Exploitation is possible only when PHP is version 8 or lower, a Contact Form 7 form with a file-upload action is present, and the separate “Redirection For Contact Form 7 Extension – Create Post” extension is also installed and active. No POP chain exists inside the vulnerable plugin itself.

An unauthenticated attacker who meets the above prerequisites can inject an arbitrary PHP object. When the Contact Form 7 plugin (a required dependency) is also present, a usable gadget chain permits deletion of arbitrary files; additional POP chains supplied by other plugins or themes could expand impact to data disclosure or code execution. The CVSS 3.1 score is 7.5 with a network attack vector, high complexity, and no required privileges or user interaction.

The supplied references point to the vulnerable code path in the plugin repository and to a Wordfence threat-intelligence entry; neither reference describes available patches or configuration work-arounds. The associated EPSS score remains flat at 0.0121 with no material increase after disclosure.