WordPress Plugin Vulnerabilities

Conditional Fields for Contact Form 7 < 2.7.3 - Unauthenticated Denial of Service

Description

The plugin is vulnerable to Denial of Service, making it possible for unauthenticated attackers to starve the server of resources.

Affects Plugins

Plugin icon
cf7-conditional-fields
Fixed in 2.7.3

References

CVE
CVE-2026-25863
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/773e2c1f-cebb-46b8-a073-98814c274b8f

Miscellaneous

Original Researcher
Rahul Karne
Verified
No
WPVDB ID
c1e06944-c46d-4588-8b7a-65916cf67cd2

Timeline

Publicly Published
2026-05-04 (about 5 months ago)
Added
2026-07-30 (about 2 months ago)
Last Updated
2026-07-30 (about 2 months ago)

Other

Published
Title
Published
2014-08-01
Title
WordPress 3.1 - PCRE Library Remote DoS
Published
2016-06-21
Title
WordPress 4.5.2 - oEmbed Denial of Service (DoS)
Published
2019-02-16
Title
PS PHPCaptcha < 1.2.0 -Denial of Service
Published
2014-11-20
Title
WordPress <= 4.0 - Long Password Denial of Service (DoS)
Published
2026-09-02
Title
Migrate Guru < 6.72 - Unauthenticated DoS