CVE-2026-25863: WordPress Plugin DoS Vulnerability Hits Contact Form 7

The National Vulnerability Database reports CVE-2026-25863, an uncontrolled resource consumption vulnerability in the Conditional Fields for Contact Form 7 WordPress plugin, affecting versions up to 2.6.7. This isn’t just a bug; it’s a direct path to server meltdown for unpatched systems. The flaw resides in the Wpcf7cfMailParser class, specifically the hide_hidden_mail_fields_regex_callback() method.

Attackers can exploit this via the REST API endpoint, supplying an arbitrarily large integer in POST parameters. Without validation or an upper bound, the method enters an unbounded loop with multiple preg_replace() operations. This rapidly exhausts server memory, crashing the PHP process and effectively taking the site offline. This is a denial-of-service attack that requires no authentication, making it particularly dangerous.

With a CVSS score of 7.5 (HIGH), this vulnerability is a critical concern for any organization running WordPress with this specific plugin. The attacker’s calculus here is simple: maximum disruption with minimal effort, leveraging a common plugin’s blind trust in user input.