Unrated severityNVD Advisory· Published Nov 11, 2026

CVE-2026-121873

Description

The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Redirection For Contact Form 7inferred2 versions
<3.2.16+ 1 more
- (no CPE)range: <3.2.16
- (no CPE)range: <3.2.16
Package: https://wordpress.org/plugins/redirection-for-contact-form-7

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/543fa273-943b-40f6-bcdf-84ca800fa46b/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000