What is the CVSS score of CVE-2026-1540?

CVE-2026-1540 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-1540?

Spam Protect for Contact Form 7 WordPress plugin versions before 1.2.10 contain a remote code execution vulnerability that allows authenticated users with editor-level permissions to execute…. A patch is available.

Is there a public PoC exploit available for CVE-2026-1540?

Yes, a public proof-of-concept exploit is available for CVE-2026-1540. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-1540?

Within 24 hours: Identify all WordPress installations using Spam Protect for Contact Form 7 and determine current plugin versions; disable the plugin if version is below 1.2.10 and cannot be immediately updated. Within 7 days: Update Spam Protect for Contact Form 7 to version 1.2.10 or later across all affected installations; audit editor-level user accounts for unauthorized activity. Within 30 days: Review and restrict editor-level permissions to only trusted administrators; implement WordPress security hardening measures including limiting administrative access and enforcing strong authentication.

PHP CVE-2026-1540

EUVD-2026-18128 HIGH

Code Injection (CWE-94)

2026-04-02 WPScan

GHSA-76vr-6c8c-grfj

WordPress PHP RCE Code Injection

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:09 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.2.10

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 06:15 euvd

EUVD-2026-18128

Analysis Generated

Apr 02, 2026 - 06:15 vuln.today

CVE Published

Apr 02, 2026 - 06:00 nvd

HIGH 7.2

DescriptionCVE.org

The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows logging to a PHP file, which could allow an attacker with editor access to achieve Remote Code Execution by using a crafted header

AnalysisAI

Remote code execution in Spam Protect for Contact Form 7 WordPress plugin before version 1.2.10 allows authenticated users with editor-level privileges to achieve arbitrary code execution by crafting malicious headers that are logged to a PHP file. The vulnerability is publicly exploitable with proof-of-concept code available, making it a critical risk for WordPress installations using affected plugin versions.

Technical ContextAI

The Spam Protect for Contact Form 7 plugin implements insecure logging functionality that writes HTTP headers directly to a PHP file without proper sanitization or escaping. By exploiting PHP's dynamic code execution capabilities, an attacker with editor-level WordPress access can inject PHP code through HTTP headers (such as User-Agent or custom headers) that gets written to the log file. When the log file is subsequently accessed or included in the WordPress execution flow, the injected PHP code executes in the context of the web server. This is a classic example of unsafe file logging (CWE-434: Unrestricted Upload of File with Dangerous Type) combined with code injection vulnerabilities. The vulnerability specifically affects the Spam Protect for Contact Form 7 plugin across all versions prior to 1.2.10.

RemediationAI

Immediately upgrade Spam Protect for Contact Form 7 to version 1.2.10 or later, which addresses the insecure logging functionality. Site administrators should access the WordPress plugin management interface, locate Spam Protect for Contact Form 7, and update to the latest available version. Until patching is complete, restrict editor-level WordPress access to trusted users only and review user account permissions to remove unnecessary elevated privileges. Additionally, audit recent server access logs and PHP files in the plugin directory for any suspicious entries that may indicate exploitation attempts. The security advisory and patch details are available at https://wpscan.com/vulnerability/ad00d1bb-ea8d-44a3-9064-6412804d9e95/.