Path Traversal Vulnerability in NYSL Spam Protect for Contact Form 7
CVE-2026-32496

6.7MEDIUM

Key Information:

Vendor

WordPress
Status
Spam Protect For Contact Form 7
Vendor
CVE Published:
25 March 2026

What is CVE-2026-32496?

A Path Traversal vulnerability exists in the NYSL Spam Protect plugin for Contact Form 7. This flaw allows unauthorized access to files outside of the restricted directory, which could lead to arbitrary file deletion and exposure of sensitive information. The vulnerability affects all versions of the Spam Protect plugin prior to 1.2.9. Users of the plugin should ensure their installation is updated to mitigate potential risks.

Affected Version(s)

Spam Protect for Contact Form 7 <= n/a

References

https://patchstack.com/database/Wordpress/Plugin/wp-conta...
vdb-entry

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrea Bocchetti | Patchstack Bug Bounty Program
.