All Post Contact Form

All Post Contact Form has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it remains unpatched as of September 2026. Their average CVSS score is 9.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.

The most common weakness is Unrestricted Upload Of File With Dangerous Type, behind 1 of the records (100%).

The one issue recorded for All Post Contact Form has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2024.

All of these findings were reported by stealthcopter. All Post Contact Form is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSCritical
9.8/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all All Post Contact Form vulnerabilities before they are exploited.

Most severe open issueCVSS 9.8CVE-2024-50523

All Post Contact Form <= 1.8.0 - Unauthenticated Arbitrary File Upload

Read the full analysis

Vulnerability Records

1 records
All Post Contact Form banner
Latestv1.8.2

All Post Contact Form

RainbowLink Inc.

Author

RainbowLink Inc.

0.0(0)
0/100
Last Updated
2026-07-20 (2mo ago)
Active Installs
10+
Downloads
7,388
Requires WP
4.7.3+
Requires PHP
8.0+
Tested up to
WP 7.0.4
Created
2017-04-14 (10y ago)

This plugin enhances your custom HTML forms by adding a confirmation screen (= “Confirmation Window”) and a submission success screen (= “Submission Window”). It collects the submitted data, presents it to the user for verification, and upon confirmation, sends it to a specified email address. This process is fully compatible with any HTML form structure. 【✨ Key Features】 – Works with any custom HTML form on Pages or Posts – Automatically generates a confirmation and submission screen – Sends submitted data to any email address of your choice – Protects your inbox from spam and rapid-fire submission attacks – Supports file attachments and multilingual forms (Japanese, English, Arabic, Chinese) – Use a single shortcode to manage multiple forms site-wide ▼Live Demo https://www.secure-formmail.net/?tag=demo-of-all-post-contact-form 【How to Use】 (0) Create your HTML form using input, textarea, etc. (If you’re unfamiliar with HTML, check our FAQ for form generator tools.) (1) Install and activate this plugin. (2) Go to Settings > Contact Form in your WordPress admin and complete the plugin setup. See: /assets/screenshot-1.png (3) Copy and paste the shortcode [rlallpostcontactform] into your target Page or Post. See: /assets/screenshot-2.png (4) At the top of your HTML form, insert the following: <form action="{Permalink from (3)}" method="POST" name="rl_apcf" onsubmit="return checkForm()" enctype="multipart/form-data"> See: /assets/screenshot-3.png 【Customization】 ●Design Customize the confirmation and submission windows via allpost-contactform.css. ●Attachments To accept file uploads, use: <input name="attachment_file" type="file"> ●Attachment Storage (v1.6.2+) Attachments are saved in /wp-content/apcf_att. .htaccess rules included for Apache 2.2/2.4. Configure access restrictions for other servers as needed. 【Email Subject Customization】 ●Full override: <input type="hidden" name="custom_apcf_subject" value="Custom Subject"> ●Add subtitle to default: <input type="hidden" name="custom_apcf_subject_sub" value="Your Subtitle"> ●Dropdown selector (v1.5.4+): <input type="hidden" name="custom_apcf_subject_show" value="Subject"> <select name="custom_apcf_subject" id="form_subject"> <option value="General Inquiry">General Inquiry</option> <option value="Partnership Proposal">Partnership Proposal</option> <option value="Sales">Sales</option> <option value="Project Pitch">Project Pitch</option> <option value="Login Issues">Login Issues</option> </select> 【Multilingual Support】 ●Language Switching Leaving the top 5 config fields blank enables automatic language switching based on browser settings. Defaults: Japanese, English, Arabic, Chinese. ✏️ Modify Default Labels Edit the following files directly: – rl-apcf-admin.php / rl-apcf-public.php – rl-apcf-admin-{lang}.php / rl-apcf-public-{lang}.php ✏️ Add New Languages https://github.com/RainbowLinkInc/All-Post-Contact-Form—for-usage-of-multilingual– 【Customizable Files】 – allpost-contactform.css – allpost-contactform.js – allpost-contactform-str_replace.php – allpost-contactform-language.php – allpost-contactform-upload_mime.php – allpost-contactform-sub12_uploadAttachment.php – Language files: * rl-apcf-admin.php / rl-apcf-public.php * rl-apcf-admin-ja.php / rl-apcf-public-ja.php * rl-apcf-admin-ar.php / rl-apcf-public-ar.php * rl-apcf-admin-zh.php / rl-apcf-public-zh.php 【FAQ】 ▼For a full list of FAQs, visit: https://www.Rainbow-Link.com/catalogue.htm?&item_no=RLF16#faq 【Support】 ▼Please contact the official developer site for support: https://www.Rainbow-Link.com/catalogue.htm?&item_no=RLF16#inquiry 【Paid Add-Ons】 – Auto Responder: https://www.Rainbow-Link.com/catalogue.htm?&item_no=RL30&link_id=wp – Carbon Copy: https://www.Rainbow-Link.com/catalogue.htm?&item_no=RL31&link_id=wp – Submission Notifications: https://www.Rainbow-Link.com/catalogue.htm?&item_no=RL32&link_id=wp – Auto Responder + CC: https://www.Rainbow-Link.com/catalogue.htm?&item_no=RL33&link_id=wp – CSV Export: https://www.Rainbow-Link.com/catalogue.htm?&item_no=RL34&link_id=wp

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C