CVE-2026-121873
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control.