Knight Squad Academy
Vulnerability advisory

CVE-2025-12718

Research by Md. Moniruzzaman Prodhan January 17, 2026
Overview

Summary

The Quick Contact Form plugin for WordPress is vulnerable to Open Mail Relay in all versions up to, and including, 8.2.6. This is due to the 'qcf_validate_form' AJAX endpoint allowing a user controlled parameter to set the 'from' email address. This makes it possible for unauthenticated attackers to send emails to arbitrary recipients utilizing the server. The information is limited to the contact form submission details.

Risk profile

CVSS assessment

5.8 · M E D I U M
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Attack vector
N E T W O R K
Complexity
L O W
Privileges
N O N E
User interaction
N O N E
Scope
C H A N G E D
Confidentiality
N O N E
Integrity
L O W
Availability
N O N E
Classification

Weaknesses

  • Improper Input Validation CWE-20
Further reading

References

2 sources
  1. plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3433286%40quick-contact-form&new=3433286%40quick-contact-form&sfp_email=&sfph_mail=
  2. www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/dc7ba538-a7ee-48c8-996c-b8db1934fdeb?source=cve