CVE-2026-1540 — Spam Protect for Contact Form 7 < 1.2.10 - Editor+ Remote Code Execution
The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows logging to a PHP file, which could allow an attacker with editor access to achieve Remote Code Executio…
Published: 2026-04-02 · CVSS: 7.2 · CVSS 3.1
The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows logging to a PHP file, which could allow an attacker with editor access to achieve Remote Code Execution by using a crafted header
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7