CVE-2026-14236 is an open redirect vulnerability (CWE-601) in the Contact Form 7 WordPress plugin prior to version 2.5. The issue arises because the plugin fails to validate the host component of user-supplied return URLs used as redirect targets after Stripe checkout success or cancellation. This allows unauthenticated attackers to craft links that redirect victims to arbitrary external websites, potentially facilitating phishing or other social engineering attacks. The vulnerability does not impact confidentiality or availability but has a limited impact on confidentiality due to the redirect.

An attacker can exploit this vulnerability to redirect users to malicious external sites after completing or canceling a Stripe checkout process. This can be used for phishing or to trick users into interacting with harmful content. There is no direct impact on data integrity or availability. The vulnerability requires user interaction (clicking a crafted link) and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a fix is released, users should be cautious about clicking on untrusted links involving Contact Form 7 Stripe checkout redirects. Monitoring vendor channels for updates is recommended.