The Redirection for Contact Form 7 plugin for WordPress up to version 3.2.4 suffers from a PHP Object Injection vulnerability due to unsafe deserialization in the delete_associated_files function. This vulnerability allows unauthenticated attackers to inject PHP objects if the 'Redirection For Contact Form 7 Extension - Create Post' extension is active and a file upload form is present. The vulnerability is mitigated on PHP versions above 8. Exploitation depends on the presence of a POP chain in other installed plugins or themes, which can lead to arbitrary file deletion, sensitive data exposure, or code execution. A gadget in Contact Form 7 facilitates arbitrary file deletion when used with this plugin and extension. The CVSS 3.1 score is 7.5 (high severity), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity.

If exploited in an environment where the required extension and a POP chain in other plugins/themes exist, attackers can perform arbitrary file deletion, retrieve sensitive data, or execute code. The vulnerability requires unauthenticated access and user interaction but has high impact on confidentiality, integrity, and availability. Sites running PHP versions above 8 are not affected. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or uninstalling the 'Redirection For Contact Form 7 Extension - Create Post' extension if not required, and avoid using this plugin on PHP versions below 8. Monitoring vendor channels for updates is recommended.