WordPress plugin
CF7 to Webhook security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 1 known vulnerability is fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium0
- Low0
All CF7 to Webhook vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host ≤5.0.0Update to 5.0.1 | CVE-2026-11395 |
- High7.2Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host
≤5.0.0Update to 5.0.1
CF7 to Webhook: common questions
Does CF7 to Webhook have known vulnerabilities?
Yes. VulnCrest Radar lists 1 known vulnerability in CF7 to Webhook: 1 high. None are known to affect version null.
How do I check which version of CF7 to Webhook I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent CF7 to Webhook vulnerability?
CVE-2026-11395, published Jun 17, 2026: CF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host. Severity: High (CVSS 7.2).
Is any CF7 to Webhook vulnerability listed in CISA KEV?
No. None of the known CF7 to Webhook vulnerabilities is currently listed in the CISA KEV catalog.