{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3247", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-04T00:06:57.248Z", "datePublished": "2025-04-16T05:23:00.706Z", "dateUpdated": "2026-04-08T16:46:27.696Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:46:27.696Z"}, "affected": [{"vendor": "rocklobsterinc", "product": "Contact Form 7", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.0.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip_spam_check' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order."}], "title": "Contact Form 7 <= 6.0.5 - Order Replay Vulnerability", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38257dbf-288e-4028-af65-85f5389888ac?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-7/tags/6.0.5/modules/stripe/stripe.php#L114"}, {"url": "https://plugins.trac.wordpress.org/changeset/3270138/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-354 Improper Validation of Integrity Check Value", "cweId": "CWE-354", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Asaf Mozes"}], "timeline": [{"time": "2025-04-15T16:56:22.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-16T13:23:21.654939Z", "id": "CVE-2025-3247", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T13:23:45.320Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3247", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-16T13:23:21.654939Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T13:23:36.712Z"}}], "cna": {"title": "Contact Form 7 <= 6.0.5 - Order Replay Vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Asaf Mozes"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "rocklobsterinc", "product": "Contact Form 7", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.0.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-15T16:56:22.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38257dbf-288e-4028-af65-85f5389888ac?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-7/tags/6.0.5/modules/stripe/stripe.php#L114"}, {"url": "https://plugins.trac.wordpress.org/changeset/3270138/"}], "descriptions": [{"lang": "en", "value": "The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip_spam_check' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-354", "description": "CWE-354 Improper Validation of Integrity Check Value"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:46:27.696Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3247", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:46:27.696Z", "dateReserved": "2025-04-04T00:06:57.248Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-16T05:23:00.706Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rocklobster:contact_form_7:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "E6C3AAB5-EA58-4D4F-BC1D-3B92CE46E134", "versionEndExcluding": "6.0.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip_spam_check' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order."}, {"lang": "es", "value": "El complemento Contact Form 7 para WordPress es vulnerable a la repetici\u00f3n de pedidos en todas las versiones hasta la 6.0.5 incluida, a trav\u00e9s de la funci\u00f3n 'wpcf7_stripe_skip_spam_check', debido a una validaci\u00f3n insuficiente en una clave controlada por el usuario. Esto permite que atacantes no autenticados reutilicen un \u00fanico PaymentIntent de Stripe para m\u00faltiples transacciones. Solo la primera transacci\u00f3n se procesa a trav\u00e9s de Stripe, pero el plugin env\u00eda un correo electr\u00f3nico con cada transacci\u00f3n realizada correctamente, lo que puede enga\u00f1ar al administrador para que complete cada pedido."}], "id": "CVE-2025-3247", "lastModified": "2025-07-08T18:13:23.407", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2025-04-16T06:15:42.933", "references": [{"source": "security@wordfence.com", "tags": ["Product", "Broken Link"], "url": "https://plugins.trac.wordpress.org/browser/contact-form-7/tags/6.0.5/modules/stripe/stripe.php#L114"}, {"source": "security@wordfence.com", "tags": ["Patch", "Broken Link"], "url": "https://plugins.trac.wordpress.org/changeset/3270138/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38257dbf-288e-4028-af65-85f5389888ac?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-354"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T21:18:37.929638+00:00", "value": {"mitigation_remediation": ["Upgrade Contact Form 7 to the latest version (6.0.6 or newer).", "If an upgrade cannot be performed immediately, disable the Stripe module in the plugin or remove the plugin entirely until a fixed release is available.", "Implement additional monitoring of orders and manually verify payment confirmations before initiating fulfillment to prevent accidental shipment of replayed orders."], "summary": {"action": "Immediate Patch", "impact": "Duplicate processing of Stripe PaymentIntents causing misleading success emails to administrators"}, "threat_synthesis": {"affected_systems": "WordPress sites running Contact Form 7 version 6.0.5 or earlier are affected. The issue originates from the Stripe integration within the plugin; only the mentioned versions contain the flawed logic.", "description_and_impact": "The vulnerability in the Contact Form 7 plugin arises from insufficient validation in the function that can skip spam checks during Stripe payments. This grants unauthenticated users the ability to repeat the same Stripe PaymentIntent across multiple form submissions. While only the first submission triggers a real charge, the plugin falsely reports success for every replayed request, potentially fooling site administrators into preparing and shipping products that were never legitimately paid for. The weakness is classified under CWE-354. The impact is mainly reputational and operational, exposing the site to unnecessary inventory depletion and mistaken fulfillment requests.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, reflecting the risk of accidental or malicious order replay. The EPSS score is less than 1\u202f%, suggesting that current exploit activity is very low, but the vulnerability is publicly documented, and an attacker could craft HTTP requests to trigger the replay without authentication. The vulnerability is not listed in the CISA KEV catalog, so there are no known active exploits, yet the simplicity of the trigger means it can be exploited quickly once the attacker obtains a Stripe PaymentIntent ID. The likely attack vector is remote, via crafted form submissions to the web server hosting the plugin."}}}}, "created": "2026-04-21T21:30:45.737960+00:00", "updated": "2026-04-21T21:30:45.737971+00:00", "vendors": []}