SEPTEMBER 20, 2026
Live Feed
Back to database
Case File

CVE-2025-13146

MEDIUM · CVSS 6.5 EPSS 0.27% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-22 · Last synced 2026-08-21

CyberRota Analysis

AI-Generated

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution due to insufficient validation of user inputs, affecting all versions up to 5.0.6. This flaw allows unauthenticated attackers to execute arbitrary shortcodes, potentially leading to unauthorized actions on the site. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
code execution

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2025-13146
Severity
MEDIUM
CVSS
6.5
EPSS
0.27%
WordPress

Original NVD Description

The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The vulnerability was partially patched in version 5.0.4.