Security Alert Summary
The Contact Form 7 – Dynamic Text Extension plugin for WordPress contains a vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes. The issue stems from a value being passed to do_shortcode without proper validation, which can lead to unintended shortcode execution in affected plugin versions.
CVE Details
- CVE ID: CVE-2025-13146
- Affected component: Contact Form 7 – Dynamic Text Extension plugin for WordPress
- Affected versions: All versions up to and including 5.0.6 (the vulnerability was partially patched in version 5.0.4)
- Published: July 22, 2026 at 12:16:54 PM
- Last modified: July 22, 2026 at 4:30:26 PM
- CVSS v3.1: Base Score 6.5, MEDIUM — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Authentication / Privileges / User interaction: Privileges Required: NONE; User Interaction: NONE; Attack Vector: NETWORK; Attack Complexity: LOW; Scope: UNCHANGED
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-94 (Improper Control of Generation of Code)
Technical Details
The plugin allows execution of an action that does not properly validate a value before calling do_shortcode. Because the input is not validated, unauthenticated attackers can supply shortcode content that will be executed by WordPress shortcode processing.
The issue is referenced in the plugin codebase at specific locations, including contact-form-7-dynamic-text-extension.php (lines noted in public trac references) and includes/utilities.php. A partial patch was applied in version 5.0.4, but the description indicates versions up to and including 5.0.6 remain vulnerable.
Impact is limited to what arbitrary shortcodes can do on the site given existing shortcode handlers. This can lead to disclosure or alteration of data accessible via those shortcodes, but the CVSS information indicates no direct availability impact and that the primary effects are on confidentiality and integrity at a low level.
How This Could Impact Your Website
On a multi-user WordPress site, an unauthenticated attacker could exploit this issue to run shortcodes that disclose data or alter content processed by those shortcodes. For example, a site owner may have internal staff and external contractors contributing content via forms or dynamic fields. If an attacker can inject or trigger a shortcode execution path, they could cause exposure of information returned by shortcodes, such as internal user email addresses or other data surfaced to form handlers.
Practical consequences include increased risk of targeted phishing or social engineering against staff and contributors if email addresses or other identifiers are exposed. The integrity impact may allow small unauthorized changes to content produced by shortcode handlers, depending on what those shortcodes are designed to do.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that can submit data.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior related to form submissions or shortcode execution.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/contact-form-7-dynamic-text-extension/trunk/contact-form-7-dynamic-text-extension.php#L765
- https://plugins.trac.wordpress.org/browser/contact-form-7-dynamic-text-extension/trunk/contact-form-7-dynamic-text-extension.php#L782
- https://plugins.trac.wordpress.org/browser/contact-form-7-dynamic-text-extension/trunk/includes/utilities.php#L265
- https://plugins.trac.wordpress.org/changeset/3430784/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3e5ad3a7-03c5-4085-bc77e7e46cea?source=cve
