CVE-2026-11395: CF7 to Webhook Plugin SSRF Vulnerability (WordPress)

Technical summary

CVE-2026-11395 is a CWE-918 server-side request forgery vulnerability in the CF7 to Webhook plugin's pull_the_trigger function. When a Contact Form 7 form is submitted, the plugin constructs an HTTP request to a configured webhook URL. If that URL contains a Contact Form 7 field placeholder (e.g., [field_name]) in the host segment, an attacker can control that placeholder value via the form submission, causing the server to make requests to attacker-specified internal or external endpoints. Because no authentication is required and the request originates from the web server itself, this can bypass network segmentation, firewall rules, and IP-based access controls protecting internal services.

Business impact

This vulnerability creates a direct pathway for attackers to reconnaissance your internal network and interact with services that should never be exposed to the internet. An attacker could use this to probe for internal APIs, databases, or administrative interfaces; extract configuration data or credentials; or trigger actions in internal systems (e.g., sending traffic to an internal service that performs side effects). For WordPress installations exposed to the public internet, this represents a significant risk if the plugin is installed and configured with vulnerable URL patterns. The lack of authentication requirements means the attack surface is maximized.

Affected systems

Any WordPress installation with the CF7 to Webhook plugin installed and enabled in versions 5.0.0 and earlier is at risk, provided the webhook URL is configured with a Contact Form 7 field placeholder in the hostname and at least one form using that webhook is publicly accessible. The vulnerability is network-accessible and requires no special privileges to trigger, making any exposed WordPress instance with this configuration a target.

Exploitability

Exploitation is practical and straightforward: an attacker submits a Contact Form 7 form with values designed to manipulate the webhook URL's host component, causing the server to make a request to an attacker-controlled or internal destination. The attack has a low complexity score and zero authentication requirement, meaning any visitor or automated scanner can attempt it. Success depends entirely on the webhook URL configuration and form accessibility—if those two preconditions are met, the vulnerability is trivial to exploit.

Remediation

Update the CF7 to Webhook plugin to a patched version released after 5.0.0 (verify against the vendor advisory for the specific version). If an update is not yet available, immediately audit your webhook URL configurations and remove any Contact Form 7 field placeholders from the host segment of the URL. Alternatively, restrict access to forms that use vulnerable webhook configurations, or temporarily disable the plugin until a patch is confirmed.

Patch guidance

Check the WordPress plugin repository and the CF7 to Webhook plugin's official website for a version newer than 5.0.0. Apply the patch as soon as it is available and verified against your testing environment. Until a patch is released, do not configure webhook URLs with Contact Form 7 field placeholders in the hostname portion. If you have already done so, remove those placeholders and redeploy the configuration immediately.

Detection guidance

Monitor your WordPress access logs for HTTP POST requests to forms that use the CF7 to Webhook plugin where the form submission contains unusual or unexpected values in fields that are mapped to the webhook URL hostname. Look for webhook requests to internal IP addresses, private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), or localhost. Implement network-level monitoring to detect outbound requests from your web server to internal infrastructure that should not be contacted by web applications. WAF rules can be tuned to detect field values that resemble hostnames or IP addresses in form submissions bound to webhook plugins.

Why prioritize this

This vulnerability scores 7.2 (HIGH) under CVSS 3.1 due to network accessibility, low complexity, and potential impact on confidentiality and integrity of internal systems. It is not yet in active exploitation tracked by CISA, but the low barrier to exploitation and high probability of misconfiguration in real deployments warrant immediate attention. Organizations running this plugin should prioritize assessment and patching within their vulnerability lifecycle.

Risk score, explained

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects: network-accessible attack vector, low complexity (no special setup required), no privileges needed, no user interaction needed, and changed scope (the impact extends to resources beyond the vulnerable component, such as internal systems). The confidentiality and integrity impact is rated low because the attacker's access is constrained by what the web server's outbound policies allow and the services' own authentication mechanisms, but the potential to query or modify internal services raises this to HIGH overall.

Frequently asked questions