VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 8 known issues Latest disclosed Apr 15, 2025

Contact Form 7 Vulnerabilities

Review known vulnerability records for the WordPress plugin Contact Form 7 (`contact-form-7`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-3247, CVE-2024-4704 and CVE-2024-2242, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
8
High or Critical
2
Patch Coverage
100%
Last Updated
Apr 16, 2025
Priority CVE Quick Links

Fast paths into Contact Form 7 CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
7
CVE-2020-35489 High 5.3.2
CVE-2020-35489 Contact Form 7 Arbitrary File Upload

Contact Form 7 <= 5.3.1 - Arbitrary File Upload via Bypass

CVE-2023-6449 Medium 5.8.4
CVE-2023-6449 Contact Form 7 Remote Code Execution

Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload

CVE-2018-20979 Medium 5.0.4
CVE-2018-20979 Contact Form 7 Authorization Bypass

Contact Form 7 <= 5.0.3 - Authorization Bypass

CVE-2024-4704 Medium 5.9.5
CVE-2024-4704 Contact Form 7 Vulnerability

Contact Form 7 <= 5.9.4 - Unauthenticated Open Redirect

CVE-2024-2242 Medium 5.9.2
CVE-2024-2242 Contact Form 7 Cross-Site Scripting

Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting

CVE-2025-3247 Medium 6.0.6
CVE-2025-3247 Contact Form 7 Vulnerability

Contact Form 7 <= 6.0.5 - Order Replay Vulnerability

CVE-2014-2265 Medium 3.7.2
CVE-2014-2265 Contact Form 7 Vulnerability

Contact Form 7 < 3.7.2 - CAPTCHA Bypass

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Contact Form 7 so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
8 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
1 critical and 1 high severity finding.
Recent CVEs
CVE-2025-3247, CVE-2024-4704 and CVE-2024-2242
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Contact Form 7

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-3247
CVE-2025-3247: Contact Form 7 <= 6.0.5 - Order Replay Vulnerability

The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip_spam_check' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse...

Published
Apr 15, 2025
Patched Release
6.0.6
Affected Versions
Versions up to 6.0.5
Next Step
Update to 6.0.6 or newer if supported.
Open CVE-2025-3247 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-4704
CVE-2024-4704: Contact Form 7 <= 5.9.4 - Unauthenticated Open Redirect

The Contact Form 7 plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 5.9.4. This is due to insufficient validation on the redirect url supplied via accessing the contact form with a spoofed page. This makes it possible for unauthenticated a...

Published
Jun 05, 2024
Patched Release
5.9.5
Affected Versions
Versions up to 5.9.4
Next Step
Update to 5.9.5 or newer if supported.
Open CVE-2024-4704 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-2242
CVE-2024-2242: Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting

The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to, and including, 5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inj...

Published
Mar 13, 2024
Patched Release
5.9.2
Affected Versions
Versions up to 5.9
Next Step
Update to 5.9.2 or newer if supported.
Open CVE-2024-2242 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6449
CVE-2023-6449: Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload

The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7_antiscript_file_name' function in versions up to, and including, 5.8.3. This makes it po...

Published
Nov 30, 2023
Patched Release
5.8.4
Affected Versions
Versions up to 5.8.3
Next Step
Update to 5.8.4 or newer if supported.
Open CVE-2023-6449 Report Open CVE Reference
Plugin High Patched: Yes CVE-2020-35489
CVE-2020-35489: Contact Form 7 <= 5.3.1 - Arbitrary File Upload via Bypass

The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads in versions up to 5.3.2. This is due to the fact that the plugin allows filenames to contain special characters which may make extension filter evasion possible on certain configurations. Our team was...

Published
Dec 17, 2020
Patched Release
5.3.2
Affected Versions
Versions before 5.3.2
Next Step
Update to 5.3.2 or newer if supported.
Open CVE-2020-35489 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2018-20979
CVE-2018-20979: Contact Form 7 <= 5.0.3 - Authorization Bypass

The Contact Form 7 plugin for WordPress is vulnerable to authorization bypass due to capability_type mishandling in register_post_type in versions up to, and including, 5.0.3. This makes it possible for authenticated attackers with contributor level privileges and above to modify...

Published
Sep 04, 2018
Patched Release
5.0.4
Affected Versions
Versions before 5.0.4
Next Step
Update to 5.0.4 or newer if supported.
Open CVE-2018-20979 Report Open CVE Reference
Plugin Critical Patched: Yes
Contact Form 7 <= 3.5.2 - Arbitrary File Upload

The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on contact form uploads in versions up to, and including, 3.5.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site...

Published
Aug 01, 2014
Patched Release
3.5.3
Affected Versions
Versions up to 3.5.2
Next Step
Update to 3.5.3 or newer if supported.
Open Full Report
Plugin Medium Patched: Yes CVE-2014-2265
CVE-2014-2265: Contact Form 7 < 3.7.2 - CAPTCHA Bypass

Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcf7_captcha_challenge_captcha-719 parameter.

Published
Feb 26, 2014
Patched Release
3.7.2
Affected Versions
Versions before 3.7.2
Next Step
Update to 3.7.2 or newer if supported.
Open CVE-2014-2265 Report Open CVE Reference