
Version Reviewed | 6.0.6 |
Creator | Takayuki Miyoshi |
Plugin Link | https://wordpress.org/plugins/contact-form-7/ |
Multi-language | yes |
Paid/Premium Version | no |
ClassicPress Compatible | no |
Nagware/Notifications | no – *note |
Add-on Plugins
- Flamingo
- Really Simple CAPTCHA
Index
The Review
WordPress comes out of the box with a bunch of neat features, but if you want user input/feedback, you’re going to need a plugin. And one plugin that has been around for ages on WordPress can solve such an issue, say hello to Contact Form 7.
Contact Form 7 plugin for WordPress is a form creation tool using short codes to place a form on any post or page. That’s about it and it does it well. There are additional add-on plugins that we’ll review at a later date, but
So for today’s review, we’ll go and test a true standard in the WordPress community, Contact Form 7.
Installation & Activation
Installation and activation seems straight forward with searching for the name in the WordPress repository, downloading and then activating the plugin. As of this time, there is no indication of any Admin notifications or nagware.
*A small issue we have personally though is information relating to updates, it seems most of the time the information is not posted on the WordPress plugin repository, but linked to their site, which might again link to the GitHub repository.
Testing
At the time of this posting, for our testing environment we used the latest version of WordPress, 6.7.2, on a Linux based server running PHP 8.2, with Nginx, and MySQL. These results may not be the same as yours.
So now comes the meat and potatoes part of our review, actually testing out the plugin. After activation we’ll need to visit the new Contacts menu to create a new form. By default, there is a basic form created and listed as Contact form 1.

If you wish, you can either user this contact form by making modifications or we can create a new one. As you can see in the image above, each form has a unique id, in this case ours is f09b72a
. This identifier is what is used for the relationship between this form and its data.

In our test we decided t just edit the default contact form created. As you’ll see in the image above, everything is created using short codes. While not as popular in WordPress today, short codes were the default way of inserting exterior functions such as plugin widgets onto any post or page.
If you’ve used WordPress’ older editor, you should be familiar with how the process should work and it should be somewhat trouble free on creating a form, an email template, and a default response after submission. If you are someone who is more accustomed to drag and drop interfaces, you’ll be left with a learning curve.
I personally like the Additional Settings feature, again by using short codes, you can add settings such as skip_mail
. This short code skips sending the form in an email and instead relies on an additional plugin called Flamingo, to store the message on site in the database. This could be used for a simple help desk submission form. All the additional features are documented on the Contact Form 7 website.
Conclusion
A basic and easy to use plugin for creating forms on your WordPress website. The plugin has well written documentation, but you’ll need to visit the sources website to read it.
Plugin Resources
A list of 3rd party libraries, API connections, PHP mods, and/or WordPress hooks that are used/required.
Vulnerabilities
Title | Effected Version | Date | Patched | CVE | CVSS |
---|---|---|---|---|---|
Order Replay Vulnerability | <= 6.0.5 | April 15, 2025 | yes – 6.0.6 | CVE-2025-3247 | 5.3 |
Unauthenticated Open Redirect | <= 5.9.4 | June 5, 2024 | yes – 5.9.5 | CVE-2024-4704 | 4.7 |
Reflected Cross-Site Scripting | <= 5.9 | March 13, 2024 | yes – 5.9.2 | CVE-2024-2242 | 6.1 |
Authenticated (Editor+) Arbitrary File Upload | <= 5.8.3 | December 1, 2023 | yes – 5.8.4 | CVE-2023-6449 | 6.6 |
Arbitrary File Upload | <= 5.3.1 | December 17, 2020 | yes – 5.3.2 | CVE-2020-35489 | 8.1 |
Privilege Escalation | <= 5.0.3 | September 4, 2018 | yes – 5.0.4 | CVE-2018-20979 | 6.3 |
Arbitrary Code Execution | <= 3.5.2 | August 1, 2014 | yes – 3.5.3 | N/A | 9.8 |
CAPTCHA Bypass | <= 3.7.1 | February 26, 2014 | yes – 3.7.2 | CVE-2014-2265 | 5.3 |