Contact Form 7

Contact form 7 settings page

Index


The Review

WordPress comes out of the box with a bunch of neat features, but if you want user input/feedback, you’re going to need a plugin. And one plugin that has been around for ages on WordPress can solve such an issue, say hello to Contact Form 7.

Contact Form 7 plugin for WordPress is a form creation tool using short codes to place a form on any post or page. That’s about it and it does it well. There are additional add-on plugins that we’ll review at a later date, but

So for today’s review, we’ll go and test a true standard in the WordPress community, Contact Form 7.

Installation & Activation

Installation and activation seems straight forward with searching for the name in the WordPress repository, downloading and then activating the plugin. As of this time, there is no indication of any Admin notifications or nagware.

*A small issue we have personally though is information relating to updates, it seems most of the time the information is not posted on the WordPress plugin repository, but linked to their site, which might again link to the GitHub repository.

Testing

So now comes the meat and potatoes part of our review, actually testing out the plugin. After activation we’ll need to visit the new Contacts menu to create a new form. By default, there is a basic form created and listed as Contact form 1.

Contact Form 7 Settings page

If you wish, you can either user this contact form by making modifications or we can create a new one. As you can see in the image above, each form has a unique id, in this case ours is f09b72a. This identifier is what is used for the relationship between this form and its data.

Edit Contact Form 7 page

In our test we decided t just edit the default contact form created. As you’ll see in the image above, everything is created using short codes. While not as popular in WordPress today, short codes were the default way of inserting exterior functions such as plugin widgets onto any post or page.

If you’ve used WordPress’ older editor, you should be familiar with how the process should work and it should be somewhat trouble free on creating a form, an email template, and a default response after submission. If you are someone who is more accustomed to drag and drop interfaces, you’ll be left with a learning curve.

I personally like the Additional Settings feature, again by using short codes, you can add settings such as skip_mail. This short code skips sending the form in an email and instead relies on an additional plugin called Flamingo, to store the message on site in the database. This could be used for a simple help desk submission form. All the additional features are documented on the Contact Form 7 website.

Conclusion

A basic and easy to use plugin for creating forms on your WordPress website. The plugin has well written documentation, but you’ll need to visit the sources website to read it.

Plugin Resources

A list of 3rd party libraries, API connections, PHP mods, and/or WordPress hooks that are used/required.

Vulnerabilities

TitleEffected VersionDatePatchedCVECVSS
Order Replay Vulnerability<= 6.0.5April 15, 2025yes – 6.0.6CVE-2025-32475.3
Unauthenticated Open Redirect<= 5.9.4June 5, 2024yes – 5.9.5CVE-2024-47044.7
Reflected Cross-Site Scripting<= 5.9March 13, 2024yes – 5.9.2CVE-2024-22426.1
Authenticated (Editor+) Arbitrary File Upload<= 5.8.3December 1, 2023yes – 5.8.4CVE-2023-64496.6
Arbitrary File Upload<= 5.3.1December 17, 2020yes – 5.3.2CVE-2020-354898.1
Privilege Escalation<= 5.0.3September 4, 2018yes – 5.0.4CVE-2018-209796.3
Arbitrary Code Execution
<= 3.5.2August 1, 2014yes – 3.5.3N/A9.8
CAPTCHA Bypass<= 3.7.1February 26, 2014yes – 3.7.2CVE-2014-22655.3