PT-2026-3337 · WordPress · Quick Contact Form

Published 2026-01-17 · Updated 2026-01-17 · CVE-2025-12718

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Quick Contact Form plugin for WordPress versions up to and including 8.2.6

Description The Quick Contact Form plugin for WordPress is susceptible to an Open Mail Relay issue. The qcf validate form API endpoint allows manipulation of the 'from' email address through a user-controlled parameter. This enables unauthenticated attackers to send emails to arbitrary recipients using the server, leveraging contact form submission details.

Recommendations Update the Quick Contact Form plugin to a version newer than 8.2.6.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-12718

Affected Products

Quick Contact Form

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-12718 · Security Note
• https://twitter.com/VulmonFeeds/status/2012379047519461419 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/dc7ba538-a7ee-48c8-996c-b8db1934fdeb?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3433286%40quick-contact-form&new=3433286%40quick-contact-form&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2012490355053105209 · Twitter Post