Security Alert Summary
The Quick Contact Form plugin for WordPress contains an Open Mail Relay vulnerability in the qcf_validate_form AJAX endpoint. The endpoint allows a user-controlled parameter to set the message “from” address, which can be abused by unauthenticated actors to send emails to arbitrary recipients using the site’s mail server. Information available to an attacker is limited to contact form submission details.
CVE Details
- CVE ID: CVE-2025-12718
- Affected component: Quick Contact Form plugin for WordPress
- Affected versions: All versions up to, and including, 8.2.6
- Published: January 17, 2026 at 03:16:03 AM UTC
- Last modified: January 17, 2026 at 03:16:03 AM UTC
- CVSS v3.1: Base Score 5.8, Severity MEDIUM
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None (Unauthenticated)
- User Interaction: None
- Scope: Changed
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
- Vector:
- Authentication / Privileges / User Interaction: Unauthenticated (no privileges required), no user interaction is required to exploit
- Primary impact: Ability to send emails from the site mail server to arbitrary recipients (integrity impact limited to mail content/source)
- Weakness (CWE): CWE-20 (Improper Input Validation)
Technical Details
The vulnerability exists because the plugin’s AJAX endpoint qcf_validate_form accepts a user-controlled parameter that is used to set the email “from” address without sufficient validation or restriction. An attacker can supply arbitrary values for that parameter, causing the application to relay messages that appear to originate from the site. This effectively allows unauthenticated users to use the site as a mail relay to send messages to arbitrary recipients.
The information an attacker can obtain or include is limited to contact form submission details. The issue is rooted in improper input validation of the email-related parameter in the AJAX handler.
How This Could Impact Your Website
Consider a small organization with a site owner, internal staff who manage content, and external contributors who submit form entries. An unauthenticated attacker could use the vulnerable contact form endpoint to send emails that appear to come from your domain. These messages could be used for spam or targeted phishing campaigns that reference contact form data or other publicly available information.
Practically, this can increase the risk of reputation damage and deliverability issues for your domain if it is used to send large volumes of unsolicited email. Contact form submission details may be exposed or included in messages composed by the attacker, but the vulnerability does not indicate broader data exfiltration beyond those submission details. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (if a fixed version is not specified in the CVE entry, check the plugin’s official changelog or repository for updates).
- Review and reduce unnecessary user roles and permissions, especially contributor-level and other non-admin roles.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and outgoing mail logs for unusual behavior or unexpected message volume.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
