What happened
CVE-2025-13146 is an unauthenticated arbitrary shortcode execution vulnerability affecting DTX – Dynamic Text Extension for Contact Form 7, a WordPress extension that adds dynamic values and shortcode-based functionality to Contact Form 7 fields.
The vulnerability exists because attacker-controlled input can reach WordPress's do_shortcode() processing without sufficient validation. That allows a remote unauthenticated visitor to cause the website to evaluate shortcodes that are registered on the affected WordPress installation.
Wordfence, the CVE Numbering Authority for the issue, assigns CVE-2025-13146 a CVSS 3.1 score of 6.5, rated Medium. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. This indicates a network-accessible vulnerability requiring no account, low attack complexity, and no interaction from another user, with lower confidentiality and integrity impact than the critical file-upload and remote-code-execution vulnerabilities seen in some other WordPress plugins.
The version history requires careful attention. The original CVE and NVD text published in July described versions through 5.0.6 as affected and noted that version 5.0.4 only partially addressed the issue. Wordfence updated its authoritative vulnerability record on September 14, 2026 and now lists all versions through 5.0.7 as affected. It also currently marks the vulnerability as unpatched, with no known fixed version available.
What is arbitrary shortcode execution?
WordPress shortcodes are small tokens that allow plugins and themes to expose dynamic functionality inside pages, posts, widgets, forms, and other content. A shortcode might display a form, retrieve user information, embed external content, run a search, generate a download link, or perform another application-defined action.
A typical shortcode might look conceptually like this:
[example_shortcode option="value"]WordPress processes registered shortcodes through functions including do_shortcode(). This is safe when the application controls which shortcode is executed and which arguments are allowed. It becomes dangerous when an unauthenticated visitor can supply arbitrary shortcode syntax and cause the server to evaluate it.
The vulnerable flow can be represented as:
Unauthenticated request
|
v
Attacker-controlled value
|
v
Insufficient validation
|
v
do_shortcode()
|
v
Registered WordPress shortcode executesThe impact depends heavily on the shortcodes available on the particular website. WordPress itself, themes, Contact Form 7 extensions, ecommerce plugins, membership systems, download managers, page builders, and custom code can all register shortcodes with different capabilities.
Why the impact varies between sites
CVE-2025-13146 should not automatically be described as remote code execution or complete site takeover. The vulnerability provides arbitrary shortcode execution, but the actions available through that primitive depend on the shortcodes registered by the rest of the WordPress environment.
On one website, the accessible shortcodes may only render public content. On another, a plugin may expose a shortcode that reads protected information, performs state-changing operations, retrieves user-specific data, interacts with files, or triggers functionality that was never intended to be callable by an anonymous visitor.
This makes the WordPress plugin inventory relevant to assessing real-world impact. The same vulnerable DTX version can represent different levels of practical risk on two websites because the available shortcode ecosystem is different.
The vulnerability is classified as CWE-94, Improper Control of Generation of Code. The CVSS score reflects that exploitation itself is relatively straightforward while the expected direct impact is more limited than a generic PHP code-execution vulnerability.
Affected versions and current patch status
The vulnerability record has changed since its initial publication. Administrators should use the latest Wordfence/CVE information rather than relying on older copies of the NVD description.
The current authoritative status is:
DTX – Dynamic Text Extension for Contact Form 7 5.0.7 and earlier: AFFECTED
Known fully patched version: NONE listed by Wordfence as of September 14, 2026The plugin's own WordPress.org changelog states that version 5.0.4, released on January 1, 2026, addressed CVE-2025-13146. However, the CVE description later characterized that change as only a partial patch. Subsequent updates to the vulnerability record extended the affected range beyond 5.0.4 and ultimately through 5.0.7.
This is an important reminder that seeing a CVE number in a software changelog does not always mean later analysis will confirm that the issue was completely resolved. Partial fixes can leave alternate paths to the same underlying weakness.
Wordfence currently recommends mitigation based on organizational risk and states that it may be appropriate to uninstall the affected software and use a replacement because no known fully patched version is listed.
Why it matters for website owners
Contact Form 7 is commonly used on public WordPress websites, and extensions such as DTX exist specifically to add dynamic functionality to forms. Public forms are reachable by anonymous visitors by design, which makes strict input validation essential.
The key concern with CVE-2025-13146 is that a visitor can potentially cross the boundary between providing data to a form and instructing WordPress to execute application functionality represented by a shortcode.
The vulnerability does not require the attacker to have a subscriber, customer, contributor, editor, or administrator account. No victim interaction is required according to the CVSS vector. That makes automated probing technically possible even though the eventual impact may vary by site.
Sites with many shortcode-heavy plugins deserve additional attention. Ecommerce, membership, LMS, download, booking, page-builder, CRM, donation, and custom business plugins may register extensive shortcode functionality. Administrators should not assume that every shortcode is harmless merely because it was originally designed to be inserted into a page by an administrator.
Relationship to an earlier shortcode vulnerability
DTX has also been affected by an earlier arbitrary shortcode execution issue, CVE-2025-63068. That vulnerability covered earlier plugin versions and was separately tracked by Wordfence.
CVE-2025-13146 is a distinct record and is important because the later remediation work did not fully eliminate the shortcode-execution problem. The current Wordfence record explicitly states that the issue was only partially patched in version 5.0.4.
For administrators, the practical lesson is to avoid assuming that updating from a very old version to 5.0.4, 5.0.6, or even 5.0.7 necessarily resolves CVE-2025-13146. The latest vulnerability record should be treated as the current source of truth until the vendor publishes and security researchers confirm a complete fix.
What to check on your site
- Confirm whether DTX – Dynamic Text Extension for Contact Form 7 is installed. Check production, staging, development, and archived WordPress sites.
- Verify the installed version. Wordfence currently lists versions through 5.0.7 as affected.
- Do not assume 5.0.4 is safe. The original remediation in that release was later determined to be incomplete.
- Review whether the plugin is actually required. If DTX functionality is unused or can be replaced safely, removing the plugin eliminates exposure to the vulnerable code.
- Inventory registered shortcodes. Pay particular attention to shortcodes provided by plugins that access private data, user accounts, downloads, ecommerce functions, membership features, or other sensitive functionality.
- Review Contact Form 7 forms using dynamic text fields. Identify which public forms depend on DTX and whether those forms are still needed.
- Review server and application logs. Look for unusual requests to form endpoints or patterns suggesting attempts to submit shortcode syntax through unexpected parameters.
- Check for unexpected content changes. If a shortcode capable of modifying or publishing data exists on the site, investigate unexplained changes that occurred while a vulnerable release was active.
- Review plugin updates regularly. The affected range changed after initial disclosure, so administrators should continue monitoring the vendor and vulnerability record for a complete fix.
Immediate mitigation
Because Wordfence currently lists no known fully patched version, administrators should first determine whether DTX is necessary for the website's current functionality.
If the plugin is not required, deactivate and remove it. If it is required for business-critical forms, administrators should review the vendor's latest guidance and consider replacing the affected functionality until a confirmed complete fix is available.
Reducing the number of available shortcodes can also reduce the potential impact, but this should be treated as defence in depth rather than a reliable remediation for the vulnerable plugin itself.
A web application firewall may help block known malicious patterns, but shortcode syntax is flexible and legitimate WordPress applications use shortcodes extensively. WAF protection should therefore not be considered equivalent to removing the vulnerable execution path.
How shortcode processing should be handled securely
Applications should avoid running do_shortcode() directly on arbitrary user-controlled values. Where shortcode support is genuinely required, the application should restrict execution to a small, explicitly approved set of shortcode names and validate every accepted attribute.
For example, a secure design should conceptually work like this:
User-controlled input
|
v
Strict validation
|
v
Allowed shortcode name?
|
yes
|
v
Validate shortcode attributes
|
v
Execute approved functionalityUnknown shortcode names should be rejected rather than passed to WordPress for general evaluation. Security-sensitive shortcodes should independently enforce their own authorization checks even if they are normally inserted only by administrators.
This defence matters because shortcode execution is an application-level capability. A shortcode should not assume that appearing inside trusted page content is the only way it can ever be invoked.
Using Vulnify for WordPress review
The WordPress Stack Checker can help website owners examine publicly detectable WordPress technologies and identify sites that warrant closer plugin inventory review.
For CVE-2025-13146, external detection has limits. Whether arbitrary shortcode execution produces meaningful impact depends on the plugins, themes, custom code, and registered shortcodes inside the application. Direct administrative review remains necessary to understand the real capabilities exposed on a particular site.
The WordPress Security Hardening Checklist provides additional guidance on maintaining plugin inventories, removing unnecessary components, managing updates, protecting administrative access, and reducing the attack surface created by third-party extensions.
Related reading
Conclusion
CVE-2025-13146 allows an unauthenticated visitor to cross an important application boundary by causing DTX – Dynamic Text Extension for Contact Form 7 to evaluate attacker-controlled shortcode content.
The vulnerability is rated Medium at CVSS 6.5 rather than Critical because arbitrary shortcode execution is not the same as unrestricted PHP execution. The actual effect depends on the shortcodes registered on the target WordPress installation. That dependency can make the vulnerability relatively limited on one site and more consequential on another.
Administrators should also pay close attention to the updated version information. Earlier records described versions through 5.0.6 as affected, while Wordfence's September 14 update now lists versions through 5.0.7 and states that no known complete patch is available.
Until a fully corrected release is confirmed, sites using DTX should assess whether the plugin is necessary, review the shortcodes available on the site, monitor vendor guidance, and consider disabling or replacing the extension where operationally practical.