Attack Chain

1. An unauthenticated attacker crafts an HTTP POST request containing malicious JavaScript within a form field.
2. The attacker targets the /wp-json/contact-form-7/v1/contact-forms/{id}/feedback REST API endpoint of a vulnerable WordPress site.
3. The malicious JavaScript is embedded within array-structured input parameters (e.g., your-name[]=payload).
4. Due to insufficient input sanitization in the Database for CF7 plugin, this crafted input bypasses standard WordPress filtering.
5. The plugin stores the unsanitized malicious payload directly into the wp_cf7db custom database table using $wpdb INSERT and serialize().
6. A legitimate user (e.g., a site administrator) accesses a WordPress page that displays the submitted form data containing the stored payload.
7. The browser renders the page, and the unsanitized malicious JavaScript retrieved from the database executes in the victim's browser context.
8. The attacker achieves arbitrary web script execution, potentially leading to session hijacking, credential theft, or further client-side compromise.

Impact

Successful exploitation of CVE-2026-13425 allows unauthenticated attackers to execute arbitrary web scripts in the context of a victim's browser. This can lead to a range of severe consequences, including session hijacking, disclosure of sensitive information, defacement of web pages, or redirecting users to malicious sites. If an administrator account is compromised, attackers could gain full control over the affected WordPress site. While specific victim counts are not available for this newly disclosed vulnerability, the widespread use of WordPress and its plugins suggests a broad potential impact for organizations utilizing the Database for CF7 plugin in versions up to 1.2.6.

Recommendation

• Immediately update the Database for CF7 plugin for WordPress to version 1.2.7 or higher to patch CVE-2026-13425.
• Deploy the Sigma rule "Detects CVE-2026-13425 Exploitation Attempt - WordPress CF7 XSS" to your SIEM to identify attempts to inject malicious array-structured input via the /wp-json/contact-form-7/v1/contact-forms/{id}/feedback endpoint.
• Block the URL /wp-json/contact-form-7/v1/contact-forms/{id}/feedback at the web application firewall (WAF) or web server level if immediate patching is not possible, ensuring the URL includes the wildcard {id} for the contact form ID.
• Monitor web server access logs for requests containing the IOC /wp-json/contact-form-7/v1/contact-forms/{id}/feedback combined with [] in the query string and suspicious characters, as described in the Sigma rule.