CVE-2025-3247

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-3247
The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip_spam_check' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/contact-form-7/tags/6.0.5/modules/stripe/stripe.php#L114 Product Broken Link
https://plugins.trac.wordpress.org/changeset/3270138/ Patch Broken Link
https://www.wordfence.com/threat-intel/vulnerabilities/id/38257dbf-288e-4028-af65-85f5389888ac?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:rocklobster:contact_form_7:*:*:*:*:*:wordpress:*:*
History

08 Jul 2025, 18:13

Type Values Removed Values Added
First Time Rocklobster
Rocklobster contact Form 7
References () https://plugins.trac.wordpress.org/browser/contact-form-7/tags/6.0.5/modules/stripe/stripe.php#L114 - () https://plugins.trac.wordpress.org/browser/contact-form-7/tags/6.0.5/modules/stripe/stripe.php#L114 - Product, Broken Link
References () https://plugins.trac.wordpress.org/changeset/3270138/ - () https://plugins.trac.wordpress.org/changeset/3270138/ - Patch, Broken Link
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/38257dbf-288e-4028-af65-85f5389888ac?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/38257dbf-288e-4028-af65-85f5389888ac?source=cve - Third Party Advisory
CPE cpe:2.3:a:rocklobster:contact_form_7:*:*:*:*:*:wordpress:*:*

16 Apr 2025, 13:25

Type Values Removed Values Added
Summary
  • (es) El complemento Contact Form 7 para WordPress es vulnerable a la repetición de pedidos en todas las versiones hasta la 6.0.5 incluida, a través de la función 'wpcf7_stripe_skip_spam_check', debido a una validación insuficiente en una clave controlada por el usuario. Esto permite que atacantes no autenticados reutilicen un único PaymentIntent de Stripe para múltiples transacciones. Solo la primera transacción se procesa a través de Stripe, pero el plugin envía un correo electrónico con cada transacción realizada correctamente, lo que puede engañar al administrador para que complete cada pedido.

16 Apr 2025, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-16 06:15

Updated : 2025-07-08 18:13

NVD link : CVE-2025-3247

Mitre link : CVE-2025-3247

CVE.ORG link : CVE-2025-3247

JSON object : View

Products Affected

rocklobster

  • contact_form_7
CWE
CWE-354

Improper Validation of Integrity Check Value