Security readout for executives and security teams
Plain-English summary
An unauthenticated attacker can make one legitimate Stripe payment appear to be multiple successful Contact Form 7 transactions. Stripe processes only the first transaction, but repeated success emails may cause staff to fulfil several orders without receiving corresponding payments.
Executive priority
Prioritize affected commerce sites because exploitation could cause direct merchandise or service loss without equivalent payment. Address promptly where staff or automation relies on email confirmations; lower the priority for installations that do not use the Stripe workflow.
Technical view
Contact Form 7 through version 6.0.5 insufficiently validates a user-controlled key in wpcf7_stripe_skip_spam_check. This permits replay of one Stripe PaymentIntent across multiple submissions. Each replay generates a successful email although Stripe processes only the first transaction, creating an integrity risk without reported confidentiality or availability impact.
Likely exposure
Exposure is limited to WordPress sites running Contact Form 7 version 6.0.5 or earlier that use its Stripe functionality and treat success emails as fulfilment authorization. Sites without that payment workflow are unlikely to face the described business impact.
Exploitation context
The issue is remotely reachable without authentication, privileges, or user interaction. The supplied sources do not establish active exploitation, and the CVE is not listed as KEV. No exploit prevalence or observed campaign information is provided.
Researcher notes
The reported weakness is CWE-354 with CVSS 3.1 score 5.3 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The machine-readable affected entry is ambiguous, but the supplied narrative explicitly identifies all versions through 6.0.5. A WordPress changeset is referenced, although this bundle does not name the first fixed release.
Mitigation direction
- Check vendor guidance and update to a vendor-confirmed release that corrects the issue.
- Until updated, verify every order directly against a unique successful Stripe payment before fulfilment.
- Avoid automated fulfilment based solely on Contact Form 7 success emails.
- Consider suspending the affected Stripe workflow if payment reconciliation cannot be enforced.
Validation and detection
- Inventory Contact Form 7 versions and identify installations running version 6.0.5 or earlier.
- Confirm whether the Contact Form 7 Stripe module is enabled and used for orders.
- Compare repeated PaymentIntent identifiers against form submissions and success emails.
- Reconcile fulfilled orders with unique, successfully processed Stripe transactions.
- After remediation, confirm the installed release is vendor-designated as fixed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-354: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-3247 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N3.91.4WordfenceVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineWordfence
Disclosed
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/38257dbf-288e-4028-af65-85f5389888ac?source=cveCVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/contact-form-7/tags/6.0.5/modules/stripe/stripe.php#L114CVE reference, Wordfence
- https://plugins.trac.wordpress.org/changeset/3270138/CVE reference, Wordfence
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Validation of Integrity Check Value
Improper Validation of Integrity Check Value represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.