Vulnerability · Published May 4, 2026 · Assigned by VulnCheck

CVE-2026-25863Conditional Fields for Contact Form 7 < 2.7.3 DoS via Uncontrolled Resource Consumption

High 7.5

In plain English

A high-severity security flaw in Conditional Fields for Contact Form 7 from Jules Colle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 60.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Conditional Fields for Contact Form 7 WordPress plugin through version 2.7.2 contains an uncontrolled resource consumption vulnerability in the Wpcf7cfMailParser class where the hide_hidden_mail_fields_regex_callback() method reads an iteration count directly from user-supplied POST parameters without validation or upper bound enforcement. Unauthenticated attackers can supply an arbitrarily large integer value through the REST API endpoint to cause unbounded loop execution with multiple preg_replace() operations, exhausting server memory and crashing the PHP process.

Affected products (as reported)

Vendor	Product	Versions
Jules Colle	Conditional Fields for Contact Form 7	0 – before 2.7.3

Weakness: CWE-1284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://wordpress.org/plugins/cf7-conditional-fields/#developers release-notes, patch
https://www.vulncheck.com/advisories/conditional-fields-for-contact-form-7-dos-via-uncontrolled-resource-consumption third-party-advisory