Spam Protect for Contact Form 7 - Editor+ Remote Code Execution vulnerability
highEditor+ Remote Code Execution vulnerability
- CVSS:
- 7.2
- Affected:
- up to 1.2.10
- Fixed in:
- 1.2.10
- Disclosed:
- Apr 3, 2026
plugin
3 known security issues reported for the Wp Contact Form 7 Spam Blocker WordPress plugin. Most recent disclosed Apr 3, 2026.
Running Wp Contact Form 7 Spam Blocker on your site? Check whether your installed version is affected.
Scan your site freeEditor+ Remote Code Execution vulnerability
The Spam Protect for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 1.2.9. This makes it possible for authenticated attackers, with Editor-level access and above, to delete arbitrary files on the server, which c...
The Spam Protect for Contact Form 7 plugin for WordPress is vulnerable to Remote Code Execution in all versions up to 1.2.10 (exclusive). This makes it possible for authenticated attackers, with Editor-level access and above, to execute code on the server.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free