anonhaven
Ad

CVE-2026-1540

HIGH CVSS 3.1: 7.2 EPSS 0.03%
Updated Apr 02, 2026
WordPress
Parameter Value
CVSS 7.2 (HIGH)
Affected Versions before 1.2.10
Type CWE-94 (Code Injection), CWE-94 Improper Control of Generation of Code ('Code Injection')
Vendor WordPress
Public PoC No

The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows logging to a PHP file, which could allow an attacker with editor access to achieve Remote Code Execution by using a crafted header

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-94 Code Injection
CWE-94 Improper Control of Generation of Code ('Code Injection')

Vulnerable Products

unknown:spam protect for contact form 7

References 1

https://wpscan.com/vulnerability/ad00d1bb-ea8d-44a3-9064-6412804d9e95/
NVD
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-5032

WordPress

7.5

CVE-2026-0688

WordPress

6.4

CVE-2026-0686

WordPress

7.2

CVE-2026-4347

Inc2734

8.1

CVE-2026-2696

WordPress

None