CVE-2026-120659: update Redirection for Contact Form 7 now

Advisory summary — reviewed 7 November 2026

Field	Status
CVE	CVE-2026-120659
Product	Redirection for Contact Form 7 (WordPress plugin)
Affected versions	All versions through 3.2.14, where a published Contact Form 7 form has the Save Entry (Save Lead) action enabled
Fixed version	3.2.15 or later; the WordPress.org directory offered 3.2.17 when checked
CVSS	Not yet assigned by NVD as at 7 November 2026
EPSS	0.474% on 6 November 2026 (FIRST EPSS)
Exploitation	Not confirmed. The CVE record describes an unauthenticated path, but this is not evidence of exploitation in the wild.
CISA KEV	Not listed when checked on 7 November 2026
Our urgency	High for sites using the affected Save Entry action: the vulnerable condition is internet-reachable through a public form and can expose server-side files permitted by the plugin's upload handling.

Action: update the plugin to 3.2.15 or later today, then review saved leads and the plugin upload directory. Do not attempt to reproduce the issue on a live site.

CVE-2026-120659 is an authorisation flaw in the Redirection for Contact Form 7 plugin. The NVD record says versions through 3.2.14 can accept unauthenticated requests that write post metadata on newly created lead posts and copy server-side files with allowed MIME-type extensions into the plugin's uploads directory.

The vulnerable route matters only where all of the following are true:

1. the plugin is installed at version 3.2.14 or earlier;
2. Contact Form 7 has a published form reachable by visitors; and
3. that form uses the plugin's Save Entry (Save Lead) action.

That condition is important. A site with the plugin installed but no published form using Save Entry is not proven affected by the described path. Equally, a version number alone does not prove compromise. Treat the version-and-configuration combination as exposure evidence, then look for unusual leads and files as containment evidence.

The public record was published on 6 November 2026. It does not establish active exploitation, a CVSS score, or a CISA KEV listing. Those are separate facts and should not be inferred from the availability of a CVE.

Are you affected?

1. Identify the installed version

WordPress dashboard path

1. Sign in with an administrator account.
2. Open Plugins → Installed Plugins.
3. Find Redirection for Contact Form 7.
4. Record the version before changing anything.

Expected result: version 3.2.15 or later is fixed for the reported issue. A version of 3.2.14 or earlier needs the configuration check below and an update.

WP-CLI alternative (run from the WordPress installation directory):

wp plugin list --name=wpcf7-redirect --fields=name,status,version,update,update_version

Expected result: the version field identifies the installed release. The update field should be none after a successful update.

Safe external check: NetTools.tech HTTP Header Check — input your own site's public URL. It can confirm that the form page is publicly reachable and whether a CDN or caching layer is in front of it. It cannot identify WordPress plugins, the plugin version, the Save Entry setting, or whether the site is vulnerable. Do not use it as a vulnerability scanner.

2. Check whether Save Entry is enabled on a published form

In WordPress, open Contact → Contact Forms. For each published form that accepts public submissions:

1. open the form;
2. select the Actions tab supplied by Redirection for Contact Form 7;
3. inspect the configured actions;
4. record whether Save Entry (Save Lead) is enabled.

Interpretation

• Affected configuration: public form + Save Entry enabled + plugin version through 3.2.14.
• Not proven affected by this path: no public form uses Save Entry, or the plugin is 3.2.15 or later.
• Not enough evidence: the plugin version or form configuration cannot be determined. Restrict public form access until it can be checked.

Take a screenshot or change record before modifying the configuration. It is useful evidence and makes rollback deliberate rather than accidental.

Prerequisites

• A current database and filesystem backup, or a hosting snapshot that you have tested restoring.
• A maintenance window if the form is business-critical.
• An administrator account or WP-CLI access.
• A documented owner for customer enquiries while the form is briefly tested.

Dashboard update

1. Go to Plugins → Installed Plugins.
2. Locate Redirection for Contact Form 7.
3. Select Update now.
4. Wait for WordPress to report that the update completed.
5. Confirm the displayed version is 3.2.15 or later.

The WordPress.org directory showed version 3.2.17 on 7 November 2026. Using the current compatible release is preferable to stopping at the minimum fixed version.

WP-CLI update

wp plugin update wpcf7-redirect
wp plugin list --name=wpcf7-redirect --fields=name,status,version,update

Expected result: the first command reports an update or that the plugin is already current. The second shows a version at or above 3.2.15 and update as none.

Validate without exploiting

1. Open each public Contact Form 7 form in a private browser window.
2. Send one harmless test submission using an agreed test address.
3. Confirm the intended confirmation, redirect, mail notification and lead capture work.
4. In the WordPress dashboard, confirm exactly one expected test lead appears where your workflow normally stores it.
5. Check web-server and PHP error logs for new plugin errors during the test.

This proves normal form processing after the patch. It does not prove that no one tried the vulnerability before the patch, and it must not be replaced with a crafted request.

Rollback

If the update breaks a required form integration:

1. Disable the plugin rather than immediately reinstalling the vulnerable version.
2. Keep the affected public form unavailable, or remove the Save Entry action while the plugin is disabled.
3. Restore the tested backup only if disabling cannot recover service and the restore is within your incident process.
4. Record the rollback time, reason and the compensating control.
5. Re-enable only after a fixed release has been tested in staging.

A rollback to 3.2.14 or earlier reintroduces the reported condition. It is not an acceptable long-term mitigation.

Vendor-supported remediation is updating to a fixed release. If an emergency change window prevents that, reduce exposure rather than inventing a server-side workaround:

1. In each public form's Actions tab, disable Save Entry (Save Lead).
2. Save the form and repeat the benign submission test.
3. Confirm that essential e-mail or redirect actions still work and that a lead is no longer stored by this action.
4. Document the operational impact: staff may need to collect submissions from the configured mailbox or another approved workflow.
5. Update the plugin at the next authorised window, then re-enable Save Entry only after validation.

This is a containment measure derived from the affected feature described in the CVE; it is not a substitute for the patch. If you cannot disable Save Entry safely, temporarily unpublish the affected public form or put it behind existing access controls until it is patched.

Preserve relevant logs before making broad clean-up changes. The CVE description does not provide indicators of compromise, so the following checks are investigative, not proof of exploitation:

• Review leads created around the time the plugin was installed or last updated for unexpected metadata, attachments or bursts of submissions.
• Review the web-server access log for unusual request volume or errors on the public form page.
• Review the plugin's upload location and WordPress uploads for files whose timestamps or names do not match legitimate submissions. Do not open untrusted files on a workstation.
• Ask the hosting provider to preserve web, PHP-FPM and WAF logs if there is credible evidence of misuse.

A suspicious file or lead warrants your incident process: preserve metadata and hashes, restrict access to the affected site, rotate credentials exposed to the web application where appropriate, and obtain specialist help. Do not delete potential evidence before recording it.

• 6 November 2026: CVE-2026-120659 was published in the NVD data feed.
• 6 November 2026: FIRST EPSS recorded a 0.474% score for the CVE.
• 7 November 2026: the WordPress.org directory listed Redirection for Contact Form 7 version 3.2.17; CISA KEV did not list this CVE when checked.
• 7 November 2026: this advisory published.

References

1. NVD CVE-2026-120659 record and API data
2. WordPress.org: Redirection for Contact Form 7
3. WordPress Plugin Directory changeset 3783145
4. FIRST EPSS API: CVE-2026-120659
5. CISA Known Exploited Vulnerabilities Catalog

Izmaiņu žurnāls

• 7 November 2026 — R1: Initial publication. Published version, affected configuration, patch and containment steps verified against the NVD record and official WordPress plugin directory.