Contact Form 7 PayPal and Stripe Add-on permits attacker-controlled checkout redirects
Contact Form 7 – PayPal & Stripe Add-on before 2.5 accepts a caller-controlled cf7pp_return URL in the Stripe checkout flow without validating its destination host. An unauthenticated attacker can prepare a checkout link whose success or cancellation flow redirects a victim to an attacker-controlled site, supporting phishing or credential theft. The upstream changelog says version 2.5 validates the return URL with wp_validate_redirect(), but it does not identify the checkout route or action.
- Component
- Contact Form 7
- Plugin slug
contact-form-7-paypal-add-on- Affected
- < 2.5
- Safe version
2.5- Published
- Jul 27, 2026
This CVE was published Jul 27, 2026 and is one of 7 known issues for this plugin.
Update, patch or deactivate.
Update Contact Form 7 – PayPal & Stripe Add-on to 2.5 or later. Audit Stripe success and cancellation URLs for untrusted external hosts, and avoid following payment links from untrusted sources until the update is complete.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site after the checkout flow.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N