CVE-2025-12718: 
WordPress vulnerability analysis and mitigation

CVE-2025-12718 is an Open Mail Relay vulnerability in the Quick Contact Form plugin for WordPress, affecting all versions up to and including 8.2.6. The flaw allows unauthenticated attackers to send emails to arbitrary recipients by abusing the plugin's qcf_validate_form AJAX endpoint, which permits user-controlled input to set the from email address. It was disclosed on January 16–17, 2026, with Wordfence as the reporting CNA. The vulnerability carries a CVSS v3.1 base score of 5.8 (Medium) (Wordfence, Red Hat CVE).

The root cause is improper input validation (CWE-20) in the qcf_validate_form AJAX endpoint of the Quick Contact Form WordPress plugin. The endpoint fails to restrict or validate the from email address parameter, allowing any unauthenticated user to supply an arbitrary sender address and trigger outbound email delivery through the hosting server. An attacker can craft an HTTP POST request to the WordPress AJAX handler (wp-admin/admin-ajax.php) with a manipulated from field, causing the server to relay emails on their behalf. The content of relayed emails is limited to contact form submission details, constraining the data an attacker can include (Wordfence, WordPress Changeset).

Successful exploitation allows unauthenticated attackers to abuse the affected WordPress server as an open mail relay, sending emails to arbitrary recipients while spoofing the sender address. This can facilitate phishing campaigns, spam distribution, and reputational damage to the hosting domain, potentially leading to the server's IP or domain being blocklisted by email providers. There is no direct confidentiality or availability impact; the integrity impact is limited to the ability to send unsolicited or deceptive emails using the server's mail infrastructure (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-12718 as of the available data. The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable by any network-accessible attacker. The EPSS score is approximately 0.077%, indicating a low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Quick Contact Form plugin (versions ≤ 8.2.6) using tools like WPScan, Shodan, or by checking the plugin's readme file at wp-content/plugins/quick-contact-form/readme.txt.
2. Locate the AJAX endpoint: The vulnerable endpoint is accessible at https://[target]/wp-admin/admin-ajax.php with the action parameter set to qcf_validate_form.
3. Craft the malicious request: Send an HTTP POST request to the AJAX endpoint, supplying a user-controlled from email address (e.g., from=victim@example.com) along with required contact form fields (name, message, recipient email).
4. Trigger email relay: The server processes the request and sends an email to the specified recipient using the attacker-controlled from address, effectively relaying mail through the victim server.
5. Abuse for phishing/spam: Repeat at scale to send phishing or spam emails to arbitrary targets, leveraging the server's mail reputation and IP address (Wordfence).

• Network: Unusual volume of outbound SMTP traffic from the WordPress server; repeated POST requests to /wp-admin/admin-ajax.php with action=qcf_validate_form from diverse or unexpected source IPs.
• Logs: Web server access logs showing high-frequency requests to admin-ajax.php with the qcf_validate_form action; mail server logs showing emails sent to a wide variety of recipients with spoofed or unexpected From addresses.
• Email Infrastructure: Server IP or domain appearing on email blocklists (e.g., Spamhaus, MX Toolbox); bounce messages or delivery failure notifications for emails not initiated by legitimate users.

Users should update the Quick Contact Form plugin to a version beyond 8.2.6, which includes a fix that restricts the from email address parameter from being user-controlled. The patch is available via the WordPress plugin repository changeset. As an interim workaround, site administrators can disable the plugin until an update is applied, or restrict access to wp-admin/admin-ajax.php for unauthenticated users where feasible (WordPress Changeset, Wordfence).

Wordfence disclosed the vulnerability and assigned the CVE as the reporting CNA. A brief technical write-up was published by Infinit Security shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond standard vulnerability aggregator reporting has been identified for this CVE.