PT-2026-50635

🗓️ 18 Jun 2026 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 5 Views

The CF7 to Webhook plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.0 via the pull the trigger. This makes it possible for unauthenticated attackers to make web requests to arbitrary locat...

Reporter	Title	Published	Views	Family All 5
CVE	CVE-2026-11395	18 Jun 202606:50	–	cve
Cvelist	CVE-2026-11395 CF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host	18 Jun 202606:50	–	cvelist
EUVD	EUVD-2026-37863	18 Jun 202606:50	–	euvd
NVD	CVE-2026-11395	18 Jun 202608:16	–	nvd
Patchstack	WordPress CF7 to Webhook plugin <= 5.0.0 - Unauthenticated Server-Side Request Forgery vulnerability	18 Jun 202609:01	–	patchstack

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/cf7-to-zapier/tags/5.0.0/modules/cf7/class-module-cf7.php
plugins	www.plugins.trac.wordpress.org/browser/cf7-to-zapier/tags/5.0.0/modules/zapier/class-module-zapier.php
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/caa5b9aa-e98c-48fc-9e63-0a1380465918
plugins	www.plugins.trac.wordpress.org/browser/cf7-to-zapier/tags/5.0.0/modules/cf7/class-module-cf7.php

18 Jun 2026 00:00Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.17.2