Quick Contact Form, CVE-2025-12718

CVE, Research URL: CVE-2025-12718
Home page URL: Security reports for Quick Contact Form
Application: Quick Contact Form
Published on: Jan 17, 2026
Research Description: The Quick Contact Form plugin for WordPress is vulnerable to Open Mail Relay in all versions up to, and including, 8.2.6. This is due to the 'qcf_validate_form' AJAX endpoint allowing a user controlled parameter to set the 'from' email address. This makes it possible for unauthenticated attackers to send emails to arbitrary recipients utilizing the server. The information is limited to the contact form submission details.
Affected versions: max 8.2.7.
Status: vulnerable