WordPress plugin
WP Contact Form 7 DB Handler security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 1 known vulnerability is fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium0
- Low0
All WP Contact Form 7 DB Handler vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.1 | Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameter ≤3.0Update to 3.1 | CVE-2026-6455 |
- High8.1Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameter
≤3.0Update to 3.1
WP Contact Form 7 DB Handler: common questions
Does WP Contact Form 7 DB Handler have known vulnerabilities?
Yes. VulnCrest Radar lists 1 known vulnerability in WP Contact Form 7 DB Handler: 1 high. None are known to affect version null.
How do I check which version of WP Contact Form 7 DB Handler I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP Contact Form 7 DB Handler vulnerability?
CVE-2026-6455, published May 27, 2026: WP Contact Form 7 DB Handler <= 3.0 - Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameter. Severity: High (CVSS 8.1).
Is any WP Contact Form 7 DB Handler vulnerability listed in CISA KEV?
No. None of the known WP Contact Form 7 DB Handler vulnerabilities is currently listed in the CISA KEV catalog.