In the past few hours a lot of Contact Form 7 users have reported that their security tools provided by Avast Software have given a security alert about Contact Form 7. In particular, the alert says it has found a Trojan Horse in one of the script files in the Contact Form 7 package.
I have confirmed no such malware exists in Contact Form 7, so I believe that it is probably a false alarm. So far we haven’t received any information from Avast about this case.
I’ll update this post when there is new information.
Contact Form 7 5.4.1 is now available. This is a maintenance release that includes several improvements and bug fixes.
Since the release of Contact Form 7 5.4 last February, a lot of problems have been reported and most of them have turned out to be caused by interference from other plugins or the theme used on the site.
Although fundamental solutions can be provided only by developers of the third-party plugins and themes, by updating to 5.4.1 you will be able to mitigate the problems.
Continue reading Contact Form 7 5.4.1
Continue reading Contact Form 7 5.4
The next major update, Contact Form 7 version 5.4, is scheduled to be released on February 24. Since 5.4 brings unusually large changes, I have decided to have a beta testing period of a few weeks before the live release.
You can download a copy of the beta version plugin package from the GitHub repository. If you find any bugs, please report back to us by creating an issue on GitHub.
If you find an add-on plugin you use doesn’t work correctly with Contact Form 7 5.4, then please report the issue to the developer of that plugin, not to us. We cannot take any responsibility with regards to 3rd-party products.
Continue reading Contact Form 7 5.4 Beta
Contact Form 7 5.3.2 has been released. This is an urgent security and maintenance release. We strongly encourage you to update to it immediately.
An unrestricted file upload vulnerability has been found in Contact Form 7 5.3.1 and older versions. Utilizing this vulnerability, a form submitter can bypass Contact Form 7’s filename sanitization, and upload a file which can be executed as a script file on the host server. This issue has been reported by Jinson Varghese Behanan from Astra Security.
Continue reading Contact Form 7 5.3.2
The Sendinblue integration module for Contact Form 7 is under development. We plan to include this module into Contact Form 7 5.4, which will be released next February.
Are you interested in being one of the initial stage users of the module? We call for volunteer beta testers to try this module on their websites and report issues if they find bugs or room for improvement.
If it is OK for you to become a beta tester, please refer to the instructions on the GitHub repository page and download a plugin package for the module.
Contact Form 7 5.3.1 is now available. 5.3.1 has been confirmed to be compatible with WordPress 5.6.
Continue reading Contact Form 7 5.3.1
Contact Form 7 5.3 is now available. The long-awaited contact form selector block for Block Editor has been introduced. You can now flexibly format a date using more natural expressions. The default contact form template has been improved again. As well as these, 5.3 adds a lot of refinements. Upgrading immediately is recommended.
Continue reading Contact Form 7 5.3
Contact Form 7 5.2.2 is now available. This is a maintenance release that includes several improvements and bug fixes.
Continue reading Contact Form 7 5.2.2
WordPress 5.5 has introduced the auto-update feature for plugins and themes. Keeping plugins and themes updated to the latest version is a key factor in managing your WordPress site securely. We strongly recommend you enable auto-updates for the Contact Form 7 plugin, but you should also be aware that there are risks involved in the use of auto-updates.
Continue reading Heads-up about auto-updates