Overview
CVE-2025-8141 is a critical vulnerability that resides in the Redirection for Contact Form 7 plugin for WordPress. The vulnerability arises due to insufficient file path validation in the delete_associated_files function, which allows an unauthenticated attacker to delete arbitrary files on the server. This poses a significant risk to WordPress websites using this plugin, as exploitation of this vulnerability could lead to remote code execution and potentially total system compromise. Considering the popularity of WordPress as a content management system, the severity of this vulnerability cannot be understated.
Vulnerability Summary
CVE ID: CVE-2025-8141
Severity: Critical (8.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Unauthenticated remote code execution, potential system compromise or data leakage
Affected Products
Product | Affected Versions
Redirection for Contact Form 7 |
How the Exploit Works
The exploit works by taking advantage of the insufficient file path validation in the delete_associated_files function present in the Redirection for Contact Form 7 plugin. By crafting a malicious request, an attacker can trick the plugin into deleting any file on the server. If the attacker chooses to delete a critical file such as wp-config.php, it could easily lead to remote code execution. This is because wp-config.php contains database credentials and other sensitive information, and its deletion could disrupt the normal operation of the WordPress site, allowing the attacker to execute their own code.
Conceptual Example Code
Here is a conceptual example of how the vulnerability might be exploited.
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.example.com
Content-Type: application/json
{
"action": "wpcf7r_ajax",
"wpcf7r_nonce": "bypass",
"task": "delete_file",
"file_path": "../../../../wp-config.php"
}In this example, the attacker sends a POST request to the admin-ajax.php file, which is responsible for processing AJAX requests in WordPress. The “action” parameter is set to “wpcf7r_ajax”, which is specific to the Redirection for Contact Form 7 plugin. The “task” parameter is set to “delete_file”, indicating that the attacker wants to delete a file. The “file_path” parameter is set to “../../../../wp-config.php”, which represents the path to the wp-config.php file relative to the plugin’s directory. Because there is no proper file path validation, the plugin deletes the wp-config.php file, potentially leading to remote code execution.
