CVE-2026-1540 — Spam Protect for Contact Form 7 < 1.2.10 - Editor+ Remote Code Execution

CVE-2026-1540

Spam Protect for Contact Form 7 < 1.2.10 - Editor+ Remote Code Execution PUBLISHED

Description (CNA)

The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows logging to a PHP file, which could allow an attacker with editor access to achieve Remote Code Execution by using a crafted header

Affected (CNA)

Vendor / product	Versions
Unknown / Spam Protect for Contact Form 7	affected 0 before 1.2.10

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/ad00d1bb-ea8d-44a3-9064-6412804d9e95/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.