CVE-2026-13425 in Database for CF7 Plugin
Summary
by MITRE • 07/29/2026
The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because Contact Form 7 accepts array-structured input for ordinary text fields (e.g., your-name[]) via the public REST API endpoint /wp-json/contact-form-7/v1/contact-forms/{id}/feedback, and the plugin stores submitted data using $wpdb INSERT with serialize() into a custom wp_cf7db table, bypassing WordPress save-time filtering via wp_insert_post/wp_kses.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The Database for CF7 plugin for WordPress presents a critical stored cross-site scripting vulnerability that affects all versions up to and including 1.2.6, classified under CWE-79 as improper neutralization of input during web output. This vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's data handling processes, creating a persistent security risk for WordPress installations. The flaw specifically manifests when the plugin processes array-structured form field values submitted through the Contact Form 7 REST API endpoint at /wp-json/contact-form-7/v1/contact-forms/{id}/feedback, where attackers can inject malicious scripts that execute whenever any user accesses pages containing the stored malicious content.
The technical implementation of this vulnerability exploits the plugin's database storage mechanism by utilizing $wpdb INSERT operations combined with serialize() functions to store submitted data into a custom wp_cf7db table. This approach bypasses standard WordPress content filtering mechanisms such as wp_insert_post and wp_kses, which are designed to sanitize and validate content before storage. The vulnerability becomes particularly dangerous because the plugin accepts array-structured input for regular text fields using syntax like your-name[], allowing attackers to craft malicious payloads that can be executed in the context of any user's browser who accesses pages containing the stored data. This represents a classic stored XSS attack vector where the malicious script is permanently stored on the server and executed whenever users view affected pages.
The operational impact of this vulnerability extends beyond simple script execution, as it allows unauthenticated attackers to potentially escalate privileges through session hijacking or credential theft operations. Attackers can leverage this weakness to execute arbitrary web scripts in the context of any user's browser, making it particularly dangerous for sites with administrative access or users who process sensitive information. The vulnerability is especially concerning because it operates without requiring authentication, meaning that anyone with knowledge of a target site's Contact Form 7 configuration can exploit this flaw. According to ATT&CK framework tactic T1566, this represents a server-side web application attack vector that can lead to persistent compromise of user sessions and data exfiltration.
Mitigation strategies for this vulnerability include immediate plugin updates to versions that address the input sanitization issues, implementing additional content filtering mechanisms at the web server level, and conducting thorough security audits of all WordPress installations using similar plugins. Organizations should also consider implementing web application firewalls with XSS detection capabilities and monitor database table contents for suspicious serialized data patterns. The recommended approach involves applying the latest plugin updates that properly sanitize array-formatted input and ensure proper output escaping before rendering stored content in user browsers. Security teams must also establish monitoring procedures to detect unauthorized modifications to the wp_cf7db table structure or unexpected data insertion patterns that could indicate exploitation attempts, as outlined in industry best practices for WordPress security hardening and vulnerability management protocols.