CVE-2025-14800 is a high-severity vulnerability in the themeisle Redirection for Contact Form 7 plugin for WordPress. The issue arises from the 'move_file_to_upload' function lacking proper file type validation, enabling unauthenticated attackers to upload arbitrary files to the server. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability affects all versions up to and including 3.2.7. If the PHP configuration 'allow_url_fopen' is enabled, attackers can upload remote files, increasing the attack surface.

Successful exploitation allows unauthenticated attackers to write arbitrary files on the server hosting the vulnerable plugin, potentially leading to remote code execution or other severe impacts on confidentiality, integrity, and availability. The CVSS score of 8.1 reflects high impact across these security dimensions. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable 'allow_url_fopen' in PHP configurations to reduce risk. Monitor for updates from themeisle regarding patches or official fixes for this vulnerability. Avoid using affected versions of the plugin or consider disabling it if possible until remediation is confirmed.