PatchTheCVEcontact form 7 vulnerabilities and fixes
Recent CVEs affecting contact form 7, with upgrade or downgrade steps. 3 tracked.
Also searched as: contactform7.
contact form 7 has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-01-15. Highest priority: CVE-2024-4704 (score 36/100).
- CVE-2025-3247 MEDIUM 5.3 UPGRADE The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.
- CVE-2025-14457 LOW 3.7 UPGRADE The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized m
- CVE-2024-4704 MEDIUM 6.1 UPGRADE The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a fal
FAQ
How do I fix contact form 7 vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is contact form 7 being exploited right now?
None of the tracked contact form 7 CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which contact form 7 CVE should I patch first?
CVE-2024-4704 currently ranks highest (36/100): The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a fal.