PT-2026-28010 · WordPress+1 · Spam Protect For Contact Form 7+1

Publicado 2026-03-25 · Atualizado 2026-04-08 · CVE-2026-32496

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NYSL Spam Protect for Contact Form 7 versions through 1.2.9

Description The software contains a flaw related to improper limitation of a pathname to a restricted directory, also known as Path Traversal. This allows an attacker to potentially access files and directories outside the intended scope. The issue impacts Spam Protect for Contact Form 7.

Recommendations Update to a version of NYSL Spam Protect for Contact Form 7 greater than 1.2.9.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-32496

Produtos afetados

Contact Form 7

Spam Protect For Contact Form 7

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-32496 · Nota de Segurança
• https://patchstack.com/database/Wordpress/Plugin/wp-contact-form-7-spam-blocker/vulnerability/wordpress-spam-protect-for-contact-form-7-plugin-1-2-9-arbitrary-file-deletion-vulnerability?_s_id=cve · Nota
• https://twitter.com/CVEnew/status/2038250175693504744 · Publicação no Twitter
• https://twitter.com/atomicedgeWAF/status/2041780594460197138 · Publicação no Twitter