PT-2026-29683 · WordPress · Spam Protect For Contact Form 7

Chiao-Lin Yu · Published 2026-04-02 · Updated 2026-04-03 · CVE-2026-1540

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spam Protect for Contact Form 7 WordPress plugin versions prior to 1.2.10

Description The Spam Protect for Contact Form 7 WordPress plugin before version 1.2.10 allows logging to a PHP file. This could allow an attacker with editor access to achieve Remote Code Execution by using a crafted header.

Recommendations Update the Spam Protect for Contact Form 7 WordPress plugin to version 1.2.10 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-1540

Affected Products

Spam Protect For Contact Form 7

References · 4

• 🔥 https://wpscan.com/vulnerability/ad00d1bb-ea8d-44a3-9064-6412804d9e95 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1540 · Security Note
• https://twitter.com/CVEnew/status/2039647710320717928 · Twitter Post
• https://twitter.com/CosmicBytez/status/2039904607863009652 · Twitter Post