VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 8 known issues Latest disclosed Apr 15, 2025

Contact Form 7 Vulnerabilities

Review known vulnerability records for the WordPress plugin Contact Form 7 (`contact-form-7`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-3247, CVE-2024-4704 and CVE-2024-2242, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
8
High or Critical
2
Patch Coverage
100%
Last Updated
May 13, 2026
Related Security Guides

Use these guides while reviewing Contact Form 7 fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize Contact Form 7 remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
7
1. Match the Package
Confirm the installed WordPress plugin slug is contact-form-7 before acting on any CVE from this cluster.
2. Sort by Severity
Start with 2 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
8 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2020-35489 High
Arbitrary File Upload remediation for Contact Form 7

Affected range: Versions before 5.3.2. Fixed version: 5.3.2.

CVE-2023-6449 Medium
Remote Code Execution remediation for Contact Form 7

Affected range: Versions up to 5.8.3. Fixed version: 5.8.4.

CVE-2018-20979 Medium
Authorization Bypass remediation for Contact Form 7

Affected range: Versions before 5.0.4. Fixed version: 5.0.4.

CVE-2024-4704 Medium
Vulnerability remediation for Contact Form 7

Affected range: Versions up to 5.9.4. Fixed version: 5.9.5.

Priority CVE Quick Links

Fast paths into Contact Form 7 CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
7
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2020-35489
Contact Form 7 <= 5.3.1 - Arbitrary File Upload via Bypass
 Arbitrary File Upload Versions before 5.3.2 5.3.2 CVSS 8.1
CVE-2023-6449
Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload
 Remote Code Execution Versions up to 5.8.3 5.8.4 CVSS 6.6
CVE-2018-20979
Contact Form 7 <= 5.0.3 - Authorization Bypass
 Authorization Bypass Versions before 5.0.4 5.0.4 CVSS 6.3
CVE-2024-4704
Contact Form 7 <= 5.9.4 - Unauthenticated Open Redirect
 Vulnerability Versions up to 5.9.4 5.9.5 CVSS 6.1
CVE-2024-2242
Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting
 Cross-Site Scripting Versions up to 5.9 5.9.2 CVSS 6.1
CVE-2025-3247
Contact Form 7 <= 6.0.5 - Order Replay Vulnerability
 Vulnerability Versions up to 6.0.5 6.0.6 CVSS 5.3
CVE-2014-2265
Contact Form 7 < 3.7.2 - CAPTCHA Bypass
 Vulnerability Versions before 3.7.2 3.7.2 CVSS 5.3
CVE-2020-35489 High 5.3.2
CVE-2020-35489 Contact Form 7 Arbitrary File Upload

Contact Form 7 <= 5.3.1 - Arbitrary File Upload via Bypass

CVE-2023-6449 Medium 5.8.4
CVE-2023-6449 Contact Form 7 Remote Code Execution

Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload

CVE-2018-20979 Medium 5.0.4
CVE-2018-20979 Contact Form 7 Authorization Bypass

Contact Form 7 <= 5.0.3 - Authorization Bypass

CVE-2024-4704 Medium 5.9.5
CVE-2024-4704 Contact Form 7 Vulnerability

Contact Form 7 <= 5.9.4 - Unauthenticated Open Redirect

CVE-2024-2242 Medium 5.9.2
CVE-2024-2242 Contact Form 7 Cross-Site Scripting

Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting

CVE-2025-3247 Medium 6.0.6
CVE-2025-3247 Contact Form 7 Vulnerability

Contact Form 7 <= 6.0.5 - Order Replay Vulnerability

CVE-2014-2265 Medium 3.7.2
CVE-2014-2265 Contact Form 7 Vulnerability

Contact Form 7 < 3.7.2 - CAPTCHA Bypass

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for Contact Form 7 so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
8 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
1 critical and 1 high severity finding.
Recent CVEs
CVE-2025-3247, CVE-2024-4704 and CVE-2024-2242
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Contact Form 7

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-3247
CVE-2025-3247: Contact Form 7 <= 6.0.5 - Order Replay Vulnerability

The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7_stripe_skip_spam_check' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse...

Published
Apr 15, 2025
Patched Release
6.0.6
Affected Versions
Versions up to 6.0.5
Next Step
Update to 6.0.6 or newer if supported.
Review CVE-2025-3247 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-4704
CVE-2024-4704: Contact Form 7 <= 5.9.4 - Unauthenticated Open Redirect

The Contact Form 7 plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 5.9.4. This is due to insufficient validation on the redirect url supplied via accessing the contact form with a spoofed page. This makes it possible for unauthenticated a...

Published
Jun 05, 2024
Patched Release
5.9.5
Affected Versions
Versions up to 5.9.4
Next Step
Update to 5.9.5 or newer if supported.
Review CVE-2024-4704 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-2242
CVE-2024-2242: Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting

The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to, and including, 5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inj...

Published
Mar 13, 2024
Patched Release
5.9.2
Affected Versions
Versions up to 5.9
Next Step
Update to 5.9.2 or newer if supported.
Review CVE-2024-2242 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6449
CVE-2023-6449: Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload

The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7_antiscript_file_name' function in versions up to, and including, 5.8.3. This makes it po...

Published
Nov 30, 2023
Patched Release
5.8.4
Affected Versions
Versions up to 5.8.3
Next Step
Update to 5.8.4 or newer if supported.
Review CVE-2023-6449 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2020-35489
CVE-2020-35489: Contact Form 7 <= 5.3.1 - Arbitrary File Upload via Bypass

The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads in versions up to 5.3.2. This is due to the fact that the plugin allows filenames to contain special characters which may make extension filter evasion possible on certain configurations. Our team was...

Published
Dec 17, 2020
Patched Release
5.3.2
Affected Versions
Versions before 5.3.2
Next Step
Update to 5.3.2 or newer if supported.
Review CVE-2020-35489 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2018-20979
CVE-2018-20979: Contact Form 7 <= 5.0.3 - Authorization Bypass

The Contact Form 7 plugin for WordPress is vulnerable to authorization bypass due to capability_type mishandling in register_post_type in versions up to, and including, 5.0.3. This makes it possible for authenticated attackers with contributor level privileges and above to modify...

Published
Sep 04, 2018
Patched Release
5.0.4
Affected Versions
Versions before 5.0.4
Next Step
Update to 5.0.4 or newer if supported.
Review CVE-2018-20979 fixed version details Open CVE Reference
Plugin Critical Patched: Yes
Contact Form 7 <= 3.5.2 - Arbitrary File Upload

The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on contact form uploads in versions up to, and including, 3.5.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site...

Published
Aug 01, 2014
Patched Release
3.5.3
Affected Versions
Versions up to 3.5.2
Next Step
Update to 3.5.3 or newer if supported.
Review Contact Form 7 vulnerability details
Plugin Medium Patched: Yes CVE-2014-2265
CVE-2014-2265: Contact Form 7 < 3.7.2 - CAPTCHA Bypass

Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcf7_captcha_challenge_captcha-719 parameter.

Published
Feb 26, 2014
Patched Release
3.7.2
Affected Versions
Versions before 3.7.2
Next Step
Update to 3.7.2 or newer if supported.
Review CVE-2014-2265 fixed version details Open CVE Reference