In the past few hours a lot of Contact Form 7 users have reported that their security tools provided by Avast Software have given a security alert about Contact Form 7. In particular, the alert says it has found a Trojan Horse in one of the script files in the Contact Form 7 package.
I have confirmed no such malware exists in Contact Form 7, so I believe that it is probably a false alarm. So far we haven’t received any information from Avast about this case.
I’ll update this post when there is new information.
Contact Form 7 5.4.1 is now available. This is a maintenance release that includes several improvements and bug fixes.
Since the release of Contact Form 7 5.4 last February, a lot of problems have been reported and most of them have turned out to be caused by interference from other plugins or the theme used on the site.
Although fundamental solutions can be provided only by developers of the third-party plugins and themes, by updating to 5.4.1 you will be able to mitigate the problems.
Contact Form 7 5.4 is now available. The Sendinblue integration module has been newly introduced. JavaScript used on the front end of websites has also been drastically improved. In addition to these changes, a lot of improvements and bug fixes have been done in 5.4. Upgrading immediately is recommended.
The next major update, Contact Form 7 version 5.4, is scheduled to be released on February 24. Since 5.4 brings unusually large changes, I have decided to have a beta testing period of a few weeks before the live release.
If you find an add-on plugin you use doesn’t work correctly with Contact Form 7 5.4, then please report the issue to the developer of that plugin, not to us. We cannot take any responsibility with regards to 3rd-party products.
Contact Form 7 5.3.2 has been released. This is an urgent security and maintenance release. We strongly encourage you to update to it immediately.
An unrestricted file upload vulnerability has been found in Contact Form 7 5.3.1 and older versions. Utilizing this vulnerability, a form submitter can bypass Contact Form 7’s filename sanitization, and upload a file which can be executed as a script file on the host server. This issue has been reported by Jinson Varghese Behanan from Astra Security.
The Sendinblue integration module for Contact Form 7 is under development. We plan to include this module into Contact Form 7 5.4, which will be released next February.
Are you interested in being one of the initial stage users of the module? We call for volunteer beta testers to try this module on their websites and report issues if they find bugs or room for improvement.
If it is OK for you to become a beta tester, please refer to the instructions on the GitHub repository page and download a plugin package for the module.
Contact Form 7 5.3 is now available. The long-awaited contact form selector block for Block Editor has been introduced. You can now flexibly format a date using more natural expressions. The default contact form template has been improved again. As well as these, 5.3 adds a lot of refinements. Upgrading immediately is recommended.
WordPress 5.5 has introduced the auto-update feature for plugins and themes. Keeping plugins and themes updated to the latest version is a key factor in managing your WordPress site securely. We strongly recommend you enable auto-updates for the Contact Form 7 plugin, but you should also be aware that there are risks involved in the use of auto-updates.
