Read the docs
TI-2026-20906 Aliases CVE-2026-25863GHSA-2g6f-p97f-gp43

Conditional Fields for Contact Form 7 < 2.7.3 DoS via Uncontrolled Resource Consumption

Priority MEDIUM 44CWE-1284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Conditional Fields for Contact Form 7 WordPress plugin through version 2.7.2 contains an uncontrolled resource consumption vulnerability in the Wpcf7cfMailParser class where the hide_hidden_mail_fields_regex_callback() method reads an iteration count directly from user-supplied POST parameters without validation or upper bound enforcement. Unauthenticated attackers can supply an arbitrarily large integer value through the REST API endpoint to cause unbounded loop execution with multiple preg_replace() operations, exhausting server memory and crashing the PHP process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00451 39th percentileScored 2026-11-07
Fix Fixed Conditional Fields for Contact Form 7 (Jules Colle): 2.7.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Jules ColleConditional Fields for Contact Form 7before 2.7.32.7.3Patch availableCNA
  • Conditional Fields for Contact Form 7 VendorJules Colle Affected before 2.7.3 Fixed in 2.7.3 Patch available CNA

Remediation

  • Fix · CNA Conditional Fields for Contact Form 7 (Jules Colle) Fixed in 2.7.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25863
  2. 2026-10-03 Alias added: GHSA-2g6f-p97f-gp43

References

Patch 1

  • TI-2024-36338 WordPress Advanced Options Editor plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
  • TI-2024-33845 WordPress Conditional Fields for Contact Form 7 plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 5.9
  • TI-2023-25946 WordPress Conditional Fields for Contact Form 7 plugin <= 2.4.1 - Broken Access Control vulnerability CVSS 3.1MEDIUM 4.3
  • TI-2024-05381 Conditional Fields for Contact Form 7 <= 2.4.13 - Cross-Site Request Forgery to Plugin Setting Reset CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences