WordPress Plugin Vulnerabilities

Quick Contact Form < 8.2.7 - Unauthenticated Open Mail Relay

Description

The plugin is vulnerable to Open Mail Relay due to the 'qcf_validate_form' AJAX endpoint allowing a user controlled parameter to set the 'from' email address. This makes it possible for unauthenticated attackers to send emails to arbitrary recipients utilizing the server. The information is limited to the contact form submission details.

Affects Plugins

Plugin icon
quick-contact-form
Fixed in 8.2.7

References

CVE
CVE-2025-12718
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/dc7ba538-a7ee-48c8-996c-b8db1934fdeb

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.8 (medium)

Miscellaneous

Original Researcher
Md. Moniruzzaman Prodhan (NomanProdhan)
Verified
No
WPVDB ID
02530349-1ab0-422b-978f-05c00a7d4bd1

Timeline

Publicly Published
2026-01-16 (about 5 months ago)
Added
2026-01-16 (about 5 months ago)
Last Updated
2026-01-16 (about 5 months ago)

Other

Published
Title
Published
2025-04-30
Title
WordPress Simple PayPal Shopping Cart < 5.1.4 - Insecure Direct Object Reference via 'quantity'
Published
2026-06-30
Title
LearnPress < 4.4.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter
Published
2021-07-27
Title
uListing < 2.0.6 - Authenticated IDOR
Published
2025-10-17
Title
WPC Smart Quick View for WooCommerce < 4.2.6 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure
Published
2025-07-25
Title
MinimogWP < 3.9.1 - Unauthenticated Price Manipulation