Improper Input Validation in Contact Form 7 Plugin for WordPress
CVE-2026-14236
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 27 July 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14236?
The Contact Form 7 plugin for WordPress prior to version 2.5 fails to properly validate the host of user-provided return URLs. This oversight allows an attacker to craft malicious links that redirect users to arbitrary external sites during the success or cancel phase of a Stripe checkout process. Such a vulnerability can lead to phishing attempts and unauthorized access, compromising user security and trust.
Affected Version(s)
Contact Form 7 0 < 2.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.