What’s Vulnerable › Vulnerabilities

CVE-2024-4704: Contact Form 7 < 5.9.5 - Unauthenticated Open Redirect

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-27 · updated 2026-06-17
• Weakness: CWE-601

Description

The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and redirect to the URL of their choosing.

Affected products

• rocklobsterinc Contact Form 7: before 5.9.5 — fixed in 5.9.5

How to fix

Upgrade to a fixed version: rocklobsterinc Contact Form 7 5.9.5. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/8bdcdb5a-9026-4157-8592-345df8fb1a17/
• https://wpscan.com/vulnerability/8bdcdb5a-9026-4157-8592-345df8fb1a17/

Get alerted when CVE-2024-4704 or the next vulnerability affects your stack