CVE-2025-3247 describes an Order Replay vulnerability in the Contact Form 7 WordPress plugin (versions up to 6.0.5). The flaw arises from insufficient validation of a user-controlled key in the 'wpcf7_stripe_skip_spam_check' function, enabling attackers to reuse a single Stripe PaymentIntent multiple times. Although Stripe processes only the first payment, the plugin erroneously sends confirmation emails for each replayed transaction, which may cause administrators to mistakenly fulfill multiple orders for a single payment.

The vulnerability allows unauthenticated attackers to cause the plugin to send multiple successful order confirmation emails for a single Stripe payment. This can lead to administrative confusion and potential financial loss due to fulfilling multiple orders without receiving corresponding payments. There is no direct compromise of payment processing integrity beyond the first transaction, and no confidentiality or availability impact is indicated.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory for updates and apply any official patches once released. Until then, consider disabling or restricting the affected Stripe payment functionality in Contact Form 7 to prevent exploitation.