CVE-2026-11395 is a Server-Side Request Forgery (SSRF) vulnerability in the CF7 to Webhook WordPress plugin by mariovalney. It affects all versions up to and including 5.0.0 via the pull_the_trigger function. The flaw allows unauthenticated attackers to induce the server to send HTTP requests to arbitrary locations, leveraging a webhook URL configured with a Contact Form 7 field placeholder in the host segment. This can lead to unauthorized querying and modification of internal services. Exploitation requires the targeted form to be publicly accessible. No official patch or remediation level has been published as of the data provided.

An attacker can exploit this SSRF vulnerability to make the server send arbitrary HTTP requests, potentially accessing or modifying internal services that are not directly accessible externally. This can lead to information disclosure and integrity impacts on internal resources. There is no indication of availability impact. The vulnerability is exploitable without authentication and user interaction, increasing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should review webhook URL configurations to avoid using Contact Form 7 field placeholders in the host segment and restrict public access to vulnerable forms if possible.