What the vulnerability does
01Description
Conditional Fields for Contact Form 7 WordPress plugin through version 2.7.2 contains an uncontrolled resource consumption vulnerability in the Wpcf7cfMailParser class where the hide_hidden_mail_fields_regex_callback() method reads an iteration count directly from user-supplied POST parameters without validation or upper bound enforcement. Unauthenticated attackers can supply an arbitrarily large integer value through the REST API endpoint to cause unbounded loop execution with multiple preg_replace() operations, exhausting server memory and crashing the PHP process.
Explanation of Vulnerability in Simple Terms
02Summary
Conditional Fields for Contact Form 7 versions before 2.7.3 contain a vulnerability that allows an attacker to cause a denial of service by making the site unavailable. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Site administrators should update to version 2.7.3 or later immediately.
What an attacker can do
03Attacker Capabilities
Make the site unavailable or unresponsive to legitimate users.
Potential impact on your site
04Site Impact
Your site may become unavailable or slow to respond to visitors using this plugin.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 4, 2026
CVE published
May 25, 2026
Record updated
