CVE-2026-24945: 
WordPress vulnerability analysis and mitigation

CVE-2026-24945 is a Missing Authorization (Broken Access Control) vulnerability in the Ultimate Addons for Contact Form 7 WordPress plugin developed by Themefic. It allows unauthenticated network attackers to exploit incorrectly configured access control security levels, potentially performing actions beyond their privilege level. All plugin versions up to and including 3.5.34 are affected; version 3.5.35 contains the fix. It carries a CVSS v3.1 base score of 5.3 (Medium), and was published on February 3, 2026, with the vulnerability originally reported on November 13, 2025 (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions fail to verify whether the requesting user has the appropriate permissions before executing privileged actions. This is a network-exploitable flaw (attack vector: Network, complexity: Low) requiring no authentication, no user interaction, and no special privileges. The root cause is a missing or improperly implemented authorization/nonce check in a function accessible to unauthenticated users, a common pattern in WordPress plugin vulnerabilities categorized under OWASP Top 10 A1: Broken Access Control (Patchstack).

Successful exploitation allows an unauthenticated attacker to perform unauthorized actions that should be restricted to higher-privileged users, resulting in a low integrity impact with no direct confidentiality or availability impact. While the individual impact is limited, this class of vulnerability is frequently leveraged in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or traffic. The practical risk includes unauthorized modification of plugin-managed data or settings within the Contact Form 7 ecosystem (Patchstack).

No public proof-of-concept exploit code or active in-the-wild exploitation has been confirmed for this specific CVE. The EPSS score is approximately 0.037%, indicating a low probability of exploitation in the near term. The vulnerability is rated Low priority by Patchstack, and it does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that broken access control vulnerabilities of this type are commonly used in mass-exploit campaigns against WordPress sites (Patchstack).

The vendor (Themefic) has released a patched version: Ultimate Addons for Contact Form 7 version 3.5.35. Site administrators should update the plugin immediately via the WordPress dashboard or by downloading the latest version from the WordPress plugin repository. If an immediate update is not possible, consult your hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

The vulnerability was discovered and reported by security researcher Legion Hunter through Patchstack's Active Vulnerability Disclosure Program (VDP) on November 13, 2025, and publicly disclosed on December 13, 2025. No significant broader media coverage or notable social media commentary has been identified beyond the standard Patchstack advisory (Patchstack).