Contact Form 7 – PayPal & Stripe Add-on < 2.5 – Open Redirect | CVE 2026-14236

Description

The plugin does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site after the checkout flow.

Proof of Concept

Prerequisites: a Contact Form 7 form with a Stripe price set and Stripe configured (the plugin's normal Stripe-payment state). No non-default option required.

An unauthenticated attacker crafts a link to the store using the attacker's own URL as the return parameter:
https://victim.example/?cf7pp_stripe_redirect=4&cf7pp_fid=4&cf7pp_return=https://attacker.example/fake-error&cf7pp_p=55

The plugin passes cf7pp_return straight into the Stripe Checkout success_url and cancel_url. The only validation is filter_var($url, FILTER_VALIDATE_URL), which any absolute external URL passes; there is no same-origin/host check:
  success_url=https://attacker.example/fake-error?cf7pp_stripe_success=1&cf7pp_fid=4&id={CHECKOUT_SESSION_ID}
  cancel_url=https://attacker.example/fake-error

The victim engages a real Stripe Checkout on the legitimate store domain and is then redirected to the attacker's site on completion (success_url) or on cancel (cancel_url), a high-credibility phishing vector. Confirmed still present in current 2.4.10: the redirect code (includes/redirect_stripe.php, includes/redirect_methods.php) is byte-identical to 2.4.6; the vendor's 2.4.8/2.4.10 security fixes only hardened the separate PayPal IPN handler.