CVE-2026-14236 in Contact Form 7 Plugin
Summary
by MITRE • 07/27/2026
The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site after the checkout flow.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability exists within the Contact Form 7 WordPress plugin version 2.4 and earlier, where insufficient input validation mechanisms fail to properly verify the host component of user-supplied return URLs during Stripe checkout processes. This flaw represents a classic open redirect vulnerability that allows attackers to manipulate redirection targets without authentication requirements. The issue stems from the plugin's failure to implement proper host validation checks before accepting and processing return URLs that are subsequently used as success and cancel redirect destinations for Stripe payment transactions.
The technical implementation of this vulnerability occurs when the plugin accepts a return URL parameter from user input without validating whether the host portion of the URL belongs to an authorized domain. This validation gap enables attackers to craft malicious links containing crafted return URLs pointing to arbitrary external domains. During the Stripe checkout process, when users complete their transactions, they are redirected to these attacker-controlled URLs instead of the intended destinations. The vulnerability specifically affects the plugin's handling of return parameters within the payment processing workflow where redirect targets are configured.
The operational impact of this vulnerability extends beyond simple redirection attacks as it creates opportunities for phishing campaigns, credential harvesting, and social engineering operations. Victims who complete Stripe checkout processes may be redirected to malicious websites that appear legitimate, potentially capturing sensitive information or conducting fraudulent activities. The unauthenticated nature of the attack means that any user accessing a crafted link can trigger the redirection without requiring login credentials or administrative privileges. This vulnerability undermines the trust model of online payment processing and exposes users to potential financial fraud.
Security professionals should note this vulnerability aligns with CWE-601 open redirect weakness category and maps to ATT&CK technique T1566.002 for phishing via email. The recommended mitigations include upgrading to Contact Form 7 version 2.5 or later where proper host validation has been implemented, implementing additional URL validation at the web application firewall level, and configuring strict domain whitelisting for redirect destinations. Organizations should also consider monitoring for suspicious redirect patterns in their analytics data and implementing user education programs to recognize potentially malicious redirection attempts during payment processing workflows.