Authorization Bypass Vulnerability in Contact Form 7 Plugin for WordPress

CVE-2026-120659

What is CVE-2026-120659?

The Contact Form 7 plugin for WordPress contains an authorization bypass vulnerability that affects all versions up to 3.2.14. This flaw arises from inadequate verification of user permissions, allowing unauthenticated attackers to execute unauthorized actions. Specifically, attackers can create lead posts and write arbitrary post meta values, as well as copy server-side files with permitted MIME-type extensions into the plugin's uploads directory. Successful exploitation relies on the presence of a published Contact Form 7 form configured with the 'Save Entry' action enabled on the targeted site.

References