WordPress Contact Form 7 Dynamic Text Extension Unauthenticated Arbitrary Shortcode Execution (CVE-2025-13146)

Vulnerability Overview Vulnerability Name: Contact Form 7 – Dynamic Text Extension <= 5.0.6 - Unauthenticated Arbitrary Shortcode Execution CVE ID: CVE-2025-13146 CVSS Score: 6.5 (Medium) Release Date: July 21, 2026 Last Update Date: July 22, 2026 Researcher: NosleeP++ Affected Range Software Type: Plugin Software Name: Contact Form 7 – Dynamic Text Extension Affected Versions: <= 5.0.3 Remediation Fix Status: Unpatched Recommended Actions: No known patches are currently available. It is recommended to investigate the vulnerability details in depth and implement mitigation measures based on your organization's risk tolerance. Uninstalling the affected software and seeking alternatives may be necessary. Vulnerability Description The Contact Form 7 – Dynamic Text Extension plugin for WordPress contains an arbitrary shortcode execution vulnerability affecting all versions up to 5.0.6. This vulnerability allows unauthenticated attackers to execute arbitrary shortcodes by manipulating validation values. This vulnerability was partially addressed in version 5.0.4. References plugins.trac.wordpress.org Additional Information Related Recent Vulnerabilities: - Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Unauthenticated Arbitrary Shortcode Execution (CVE-2025-63068) - Contact Form 7 Dynamic Text Extension <= 5.0.1 - Cross-Site Request Forgery (CVE-2024-56218) - Contact Form 7 – Dynamic Text Extension <= 4.5 - Information Disclosure via Shortcode (CVE-2024-10084) - Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference (CVE-2023-6630) - Contact Form 7 Dynamic Text Extension <= 2.0.3 - Authenticated (Contributor) Stored Cross-Site Scripting via Shortcode (CVE-2023-6630) - Contact Form 7 Dynamic Text Extension <= 2.0.3 - Reflected Cross-Site Scripting (CVE-2023-6630) Summary This vulnerability allows unauthorized users to execute arbitrary shortcodes, affecting multiple versions of the Contact Form 7 – Dynamic Text Extension plugin. No known patches are currently available; it is recommended to implement mitigation measures or seek alternative solutions.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Contact Form 7 Dynamic Text Extension Unauthenticated Arbitrary Shortcode Execution (CVE-2025-13146)

More from this source