CVE-2026-1540: Spam Protect CF7 WordPress Plugin PHP Log RCE

Executive Summary

A high-severity Remote Code Execution vulnerability (CVE-2026-1540) has been discovered in the Spam Protect for Contact Form 7 WordPress plugin, affecting all versions prior to 1.2.10. The flaw carries a CVSS base score of 7.2 and requires Editor-level privileges to exploit.

The vulnerability arises because the plugin writes debugging or logging data — including user-controlled HTTP headers — directly into a PHP file rather than a plain text log. An attacker with Editor access can inject arbitrary PHP code into a crafted header, which is then written to the log file and subsequently executed by the web server when that PHP file is accessed.

WordPress site operators running this plugin should update to version 1.2.10 or later immediately.

Vulnerability Overview

Affected Versions

Technical Analysis

Root Cause

The Spam Protect for Contact Form 7 plugin includes debug/logging functionality that writes activity records to a .php file in the WordPress directory structure. The logging code incorporates HTTP request headers into the log entries without adequate sanitisation.

Because the log target is a PHP file rather than a .log or .txt file, any PHP code written to the log file is executable by the web server if the file is accessed directly via HTTP — a textbook PHP log poisoning attack.

Attack Flow

1. Attacker authenticates to WordPress with Editor-level credentials
   (may be obtained via credential stuffing, phishing, or brute-force)
 
2. Attacker sends a POST request with a crafted HTTP header, e.g.:
   X-Debug-Header: <?php system($_GET['cmd']); ?>
 
3. The plugin logs the request including the crafted header into:
   /wp-content/plugins/spam-protect-cf7/logs/debug.php (or similar)
 
4. Attacker issues a GET request to the PHP log file:
   GET /wp-content/plugins/spam-protect-cf7/logs/debug.php?cmd=id
 
5. Web server parses and executes the PHP log file
   — PHP code injected in step 2 executes as the web server user
 
6. Attacker achieves arbitrary OS command execution on the server

Why Editor Access Is Still Dangerous

While requiring Editor privileges raises the bar versus unauthenticated exploitation, Editor accounts in WordPress have significant capabilities and are common targets:

• Many WordPress sites have multiple Editor accounts across content teams
• Editor credentials are frequently targeted in phishing campaigns
• Credential dumps from other breaches are regularly tested against WordPress admin panels
• Insider threats and compromised employee accounts are realistic attack paths

An RCE from Editor-level access in a shared hosting environment can lead to cross-site compromise of other accounts on the same server.

Impact Assessment

Immediate Remediation

Step 1: Update the Plugin

# Via WP-CLI
wp plugin update spam-protect-contact-form-7
 
# Verify installed version
wp plugin get spam-protect-contact-form-7 --field=version
# Expected: 1.2.10 or higher

Or update through WordPress Admin > Plugins > Installed Plugins > Spam Protect for Contact Form 7 > Update Now.

Step 2: Deactivate If Update Is Not Immediately Possible

# Deactivate via WP-CLI
wp plugin deactivate spam-protect-contact-form-7

Or navigate to WordPress Admin > Plugins, find the plugin, and click Deactivate.

Step 3: Check for Existing Log Files

# Locate PHP log files created by the plugin
find /path/to/wordpress/wp-content/plugins/spam-protect-contact-form-7/ \
  -name "*.php" -newer /path/to/wordpress/wp-config.php
 
# Check for webshell signatures in any discovered PHP logs
grep -r "system\|exec\|passthru\|shell_exec\|eval\|base64_decode" \
  /path/to/wordpress/wp-content/plugins/spam-protect-contact-form-7/

Remove any PHP log files discovered and audit them for evidence of prior exploitation.

Step 4: Audit Editor Accounts

# List all Editor-level accounts
wp user list --role=editor --fields=user_login,user_email,user_registered
 
# Check recent login events for Editor accounts (requires audit plugin)
wp db query "SELECT user_login, user_email FROM wp_users \
  WHERE ID IN (SELECT user_id FROM wp_usermeta WHERE meta_key = 'wp_capabilities' \
  AND meta_value LIKE '%editor%');"

Detection Indicators

Post-Remediation Checklist

1. Update Spam Protect CF7 to version 1.2.10 or later
2. Deactivate if update cannot be applied immediately
3. Locate and delete any PHP log files in the plugin directory
4. Grep for webshells in wp-content/ — look for eval, base64_decode, system
5. Audit all Editor accounts — revoke any that appear unauthorised
6. Review access logs for requests to plugin PHP paths
7. Restrict web server read access to log directories via .htaccess or Nginx config
8. Deploy a WAF with PHP code injection detection rules (Wordfence, Sucuri, Cloudflare)
9. Enable two-factor authentication on all WordPress admin/editor accounts
10. Consider log directory protection — configure web server to deny execution of files in logs/ directories

References

• NVD — CVE-2026-1540
• WPScan Vulnerability Database
• Wordfence Intelligence