Conditional Fields for Contact Form 7

Conditional Fields for Contact Form 7 has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 5 are fixed as of September 2026. Their average CVSS score is 4.5, and the most serious one scores 5.3 out of 10. 2024 was the busiest year with 2 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (40%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting.

Every one of the 5 issues recorded for Conditional Fields for Contact Form 7 has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (2) reported by Abdi Pranata. Conditional Fields for Contact Form 7 is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
4.5/ 10
Patch Coverage100%
Open

0

Fixed

5

Get automatic notifications for all Conditional Fields for Contact Form 7 vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2026-25863

Conditional Fields for Contact Form 7 <= 2.7.2 - Unauthenticated Denial of Service

Read the full analysis

Vulnerability Records

5 records
Conditional Fields for Contact Form 7 banner
Latestv2.7.13

Conditional Fields for Contact Form 7

Jules Colle

Author

Jules Colle

4.8(166)
96/100
Last Updated
2026-09-06 (6d ago)
Active Installs
100,000+
Downloads
6,951,288
Requires WP
5.9+
Requires PHP
7.0+
Tested up to
WP 7.1
Created
2016-06-01 (10y ago)
Requires Plugins
contact-form-7

This plugin adds conditional logic to Contact Form 7. If you edit your CF7 form, you will see an additional tag called “Conditional fields Group”. Everything you put between the start and end tag will be hidden by default. After you have added the field group(s), go to the “Conditional fields” tab to create one or more conditions that will make the group(s) appear. Conditional Fields for Contact Form 7 is an independent plugin. This plugin is not affiliated with or endorsed by the developers of Contact Form 7. How to use it Follow this tutorial Main features Support for required fields Required fields inside hidden groups will never trigger validation errors. Hide/show info in emails based on what groups are visible Conditional groups can now be added to the emails as well. Just wrap the content with [group-name] ... [/group-name] tags. To show content only when a group is hidden, invert the tag with an exclamation mark: [!group-name] ... [/!group-name]. Groups can be nested Groups can be nested, both in the form and in the email Example form: [group group-1] [group group-inside-1] ... [/group] [/group] Example email: [group-1] [group-inside-1] ... [/group-inside-1] [/group-1] Advanced Advanced users can code up the conditions as plain text instead of using the select boxes, using the Text View. Need more power? Just like WordPress, the power of Contact Form 7 lies in its rich eco-system of extensions that build on top of it. However, it can be difficult to find a set of complex extensions that work well together. That’s why I created Conditional Fields Pro. It adds some powerful features to Contact form 7 and guarantees that everything will run smoothly with Conditional Fields. Pro features include: Repeatable fields (repeaters) Forms with multiple steps (multistep) Calculated fields Advanced conditions with JavaScript functions Multiple file upload Get the PRO version of Conditional Fields for Contact Form 7!

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C