Which versions of Conditional Fields for Contact Form 7 are affected by CVE-2026-25863?

The Conditional Fields for Contact Form 7 WordPress plugin contains a denial-of-service vulnerability (CVE-2026-25863) that allows unauthenticated attackers to crash PHP processes via REST API…. A patch is available.

How to fix or mitigate CVE-2026-25863?

Within 24 hours: Identify all WordPress instances running Conditional Fields for Contact Form 7 and document current plugin versions. Within 7 days: Update the plugin to the vendor-patched version (post-2.6.7); if version number is unavailable from vendor, contact plugin maintainers for exact fixed release. Within 30 days: Conduct POST-patch validation testing on affected WordPress environments to confirm DoS vectors are mitigated and normal form processing functions correctly.

Conditional Fields for Contact Form 7 CVE-2026-25863

Q: What is the CVSS score of CVE-2026-25863?

CVE-2026-25863 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-27083 HIGH

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-05-04 VulnCheck

Denial Of Service PHP WordPress

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 04, 2026 - 19:31 vuln.today

CVSS changed

May 04, 2026 - 19:22 NVD

7.5 (HIGH) 8.7 (HIGH)

DescriptionCVE.org

Conditional Fields for Contact Form 7 WordPress plugin through version 2.6.7 contains an uncontrolled resource consumption vulnerability in the Wpcf7cfMailParser class where the hide_hidden_mail_fields_regex_callback() method reads an iteration count directly from user-supplied POST parameters without validation or upper bound enforcement. Unauthenticated attackers can supply an arbitrarily large integer value through the REST API endpoint to cause unbounded loop execution with multiple preg_replace() operations, exhausting server memory and crashing the PHP process.

AnalysisAI

Denial-of-service condition in Conditional Fields for Contact Form 7 WordPress plugin allows remote unauthenticated attackers to crash PHP processes by injecting arbitrarily large iteration values through REST API parameters. The Wpcf7cfMailParser class processes user-supplied POST data without validation, enabling attackers to trigger unbounded loops with multiple regex operations that exhaust server memory. Affects all versions through 2.6.7 with vendor patch now available. EPSS data not provided, but the network-accessible unauthenticated attack vector (AV:N/PR:N) combined with low complexity (AC:L) indicates straightforward exploitation potential against publicly accessible WordPress sites running this plugin.

Technical ContextAI

This vulnerability stems from CWE-1284 (Improper Validation of Specified Quantity in Input), a resource exhaustion class where user-controlled numeric input directly controls computational intensity. The Conditional Fields for Contact Form 7 plugin extends the popular Contact Form 7 WordPress plugin to add conditional logic to form fields. The vulnerable Wpcf7cfMailParser class contains a hide_hidden_mail_fields_regex_callback() method that accepts iteration count parameters from POST requests through WordPress REST API endpoints. Without input validation or bounds checking, an attacker-supplied integer directly controls loop iterations performing preg_replace() operations-PHP's regular expression replacement function known for memory-intensive processing. Each iteration multiplies memory consumption, and with sufficiently large values (e.g., hundreds of thousands or millions), the PHP process exceeds memory_limit configuration and terminates. This represents a classic algorithmic complexity attack where minimal attacker resources (a single HTTP request) consume disproportionate server resources.

RemediationAI

Upgrade Conditional Fields for Contact Form 7 to version 2.6.8 or later through the WordPress admin dashboard (Plugins → Updates) or by downloading from https://wordpress.org/plugins/cf7-conditional-fields/#developers. The patched version implements input validation and bounds checking on iteration count parameters in the Wpcf7cfMailParser class. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Disable WordPress REST API for unauthenticated users via security plugin or .htaccess rules-blocks the attack vector but may break legitimate functionality for contact forms, mobile apps, or third-party integrations requiring API access; (2) Configure PHP memory_limit and max_execution_time to lower values (e.g., 128M, 30 seconds) to limit blast radius-reduces impact of successful attacks but may cause legitimate long-running processes to fail; (3) Deploy web application firewall rules to detect and block POST requests with abnormally large numeric parameter values to plugin REST endpoints-effective mitigation but requires WAF infrastructure and ongoing rule tuning to avoid false positives. Note that simply deactivating the plugin eliminates risk but removes conditional field functionality from all Contact Form 7 forms.