Uncontrolled Resource Consumption in Contact Form 7 Plugin by WordPress

CVE-2026-25863

What is CVE-2026-25863?

The Conditional Fields for Contact Form 7 plugin, through version 2.6.7, has a vulnerability in the Wpcf7cfMailParser class. This issue arises from the hide_hidden_mail_fields_regex_callback() method, which accepts an iteration count directly from unsanitized user input via POST parameters. This lack of validation allows unauthenticated attackers to provide excessively large integers through the REST API endpoint, leading to unbounded loop execution. This can result in multiple preg_replace() operations that progressively exhaust server memory, ultimately crashing the PHP process and causing significant disruption to the affected WordPress sites.

References