CVE-2026-25863

Conditional Fields for Contact Form 7 < 2.7.3 DoS via Uncontrolled Resource Consumption

Conditional Fields for Contact Form 7 WordPress plugin through version 2.7.2 contains an uncontrolled resource consumption vulnerability in the Wpcf7cfMailParser class where the hide_hidden_mail_fields_regex_callback() method reads an iteration count directly from user-supplied POST parameters without validation or upper bound enforcement. Unauthenticated attackers can supply an arbitrarily large integer value through the REST API endpoint to cause unbounded loop execution with multiple preg_replace() operations, exhausting server memory and crashing the PHP process.

We have discovered 26,557 live websites that are affected by CVE-2026-25863.

Run a Free Instant Scan



Affected Software

Product  Cf7 Conditional Fields
Category Wordpress Plugins
Vulnerable Domains26,557 live websites (53% of Cf7 Conditional Fields install base)
Vulnerable Versions
  • from 0 through 2.7.3
Vulnerable Versions Count125 versions ( 92% of all versions)


Common Weakness Enumeration

CWE-1284 Improper Validation of Specified Quantity in Input



Details

  • Published - May 4, 2026
  • Updated - May 25, 2026

Credits

  • Rahul Karne (finder)
  • VulnCheck (finder)

Website Distribution by Country

Number of websites using CVE-2026-25863
United States4,314 websites


Japan4,128 websites
Germany2,823 websites
Italy1,754 websites
France1,738 websites
Spain982 websites
GB866 websites
Poland767 websites
Netherlands754 websites
Brazil552 websites

Website Distribution by TLD

Number of websites using CVE-2026-25863
.com8,828 websites
.de1,812 websites
.it1,223 websites
.jp1,073 websites
.org1,064 websites
.co.jp1,019 websites
.fr761 websites
.nl685 websites
.net560 websites
.pl545 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-25863

Top websites that are affected by CVE-2026-25863. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**************.de Germany*,***
******.com United States*,***
**********.com United States**,***
*********.**.jp Japan**,***
****.org France**,***
****.net Japan**,***
**************.app Germany**,***
********.net GB**,***
****************.**.uk GB**,***
********************.de Germany**,***
See full domain list

FAQ

CVE-2026-25863 is Improper Validation of Specified Quantity in Input in Cf7 Conditional Fields
A total of 26,557 websites have been identified as vulnerable to CVE-2026-25863, based on global website indexing conducted by WebTechSurvey.
The Cf7 Conditional Fields is affected by the CVE-2026-25863 vulnerability.
Cf7 Conditional Fields versions up to 2.7.3 are vulnerable to CVE-2026-25863.
CVE-2026-25863 is resolved in version 2.7.3 of Cf7 Conditional Fields.