{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-121873", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-11-04T10:21:12.681Z", "datePublished": "2026-11-11T06:00:11.842Z", "dateUpdated": "2026-11-11T11:36:28.608Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-11-11T06:00:11.842Z"}, "title": "Redirection for Contact Form 7 2.6.0 - 3.2.15 - Unauthenticated Forged Personal Data Request Creation", "problemTypes": [{"descriptions": [{"description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Redirection for Contact Form 7", "versions": [{"status": "affected", "versionType": "semver", "version": "2.6.0", "lessThan": "3.2.16"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control."}], "references": [{"url": "https://wpscan.com/vulnerability/543fa273-943b-40f6-bcdf-84ca800fa46b/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Akshat Parikh (SN1PER)", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-11T11:19:47.984392Z", "id": "CVE-2026-121873", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-11T11:36:28.608Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Redirection for Contact Form 7", "vendor": "Unknown", "versions": [{"lessThan": "3.2.16", "status": "affected", "version": "2.6.0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control."}], "id": "CVE-2026-121873", "lastModified": "2026-11-11T06:17:17.140", "metrics": {}, "published": "2026-11-11T06:17:17.140", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/543fa273-943b-40f6-bcdf-84ca800fa46b/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Received"}

{}

{}