Now officially on WordPress.org

CVE Database / CVE-2026-32496

CVE · Medium

CVE-2026-32496 — Spam Protect for Contact Form 7 [wp-contact-form-7-spam-blocker] < 1.2.10

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-32496 Spam Protect for Contact Form 7 [wp-contact-form-7-spam-blocker] < 1.2.10 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Medium 6.8 < 1.2.10 1.2.10 2026-03-20 —

CVE-2026-32496

The Spam Protect for Contact Form 7 plugin has a weakness in its handling of file paths that allows an attacker with elevated privileges to erase any file from the site's server. This vulnerability exists in all plugin versions up through and including 1.2.9, potentially enabling the deletion of critical files like wp-config.php if targeted, which could then be exploited for remote code execution.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings