CVE-2025-3247

Contact Form 7 <= 6.0.5 - Order Replay Vulnerability

The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip_spam_check' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order.

We have discovered 1,562,221 live websites that are affected by CVE-2025-3247.

Run a Free Instant Scan



Affected Software

Product  Contact Form 7
Category Form Builders
Vulnerable Domains1,562,221 live websites (44% of Contact Form 7 install base)
Vulnerable Versions
  • from 0 through 6.0.5
Vulnerable Versions Count101 versions ( 81% of all versions)


Common Weakness Enumeration

CWE-354 Improper Validation of Integrity Check Value



Details

  • Published - Apr 16, 2025
  • Updated - Jul 25, 2026

Credits

  • Asaf Mozes (finder)

Website Distribution by Country

Number of websites using CVE-2025-3247
United States287,552 websites


Japan176,051 websites
Germany145,803 websites
France97,912 websites
Italy85,652 websites
Russia64,536 websites
GB62,073 websites
Spain52,511 websites
Poland49,820 websites
Netherlands48,927 websites

Website Distribution by TLD

Number of websites using CVE-2025-3247
.com604,195 websites
.de82,693 websites
.it60,387 websites
.ru52,234 websites
.org47,999 websites
.nl42,793 websites
.net40,862 websites
.fr40,041 websites
.jp38,467 websites
.co.uk37,934 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2025-3247

Top websites that are affected by CVE-2025-3247. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****.br Brazil***
********.com Singapore*,***
***.domains Bulgaria*,***
************.com United States*,***
*******.org United States*,***
************.com GB*,***
***************.com United States*,***
*********.com United States*,***
***************.com GB*,***
***************.com United States*,***
See full domain list

FAQ

CVE-2025-3247 is Improper Validation of Integrity Check Value in Contact Form 7
A total of 1,562,221 websites have been identified as vulnerable to CVE-2025-3247, based on global website indexing conducted by WebTechSurvey.
The Contact Form 7 is affected by the CVE-2025-3247 vulnerability.
Contact Form 7 versions up to and including 6.0.5 are vulnerable to CVE-2025-3247.