WordPress Redirection for Contact Form 7 Plugin Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the Redirection for Contact Form 7 plugin for WordPress, affecting all versions through 3.2.4. The issue arises from inadequate file path validation in the delete_associated_files function, enabling unauthenticated attackers to delete arbitrary files on the server. This vulnerability could easily lead to remote code execution if a critical file, such as wp-config.php, is deleted.

Impact

Exploitation of this vulnerability could result in unauthorized deletion of files on the server, potentially leading to remote code execution if a sensitive file is removed.

Remediation

Users are advised to update the Redirection for Contact Form 7 plugin to version 3.2.5 or a newer patched version.