このページは日本語でもご利用いただけます。
Contact Form 7 version 6.2.5 is now available. This is a minor update release that includes security fixes and enhancements. The risk level is not high, but it’s about security, so we advise you all to update soon.
Security issues fixed
6.2.5 fixes two separate issues:
- Non-public post data leaks through the
[_post_*]mail-tags, reported by Doston Abdullayev - User metadata leaks through form-tags with
default:user_*options, reported by Epihack Bénin
Both issues are reported to us via WPScan.
Major changes
- SWV-PHP: Marks
WPCF7_SWV_Schema::add_rule()deprecated. - Frontend JS: Corrects RegExp patterns with the
g(global) flag. - SMT: Checks if the container post is viewable.
- Restricts
default:user_*form-tag options using safelist. - Stripe: Enhances spam protection against invalid Payment Intent reference.
You can browse the complete list of changes on GitHub.
Requires: WordPress 7.1 or higher
Tested up to: WordPress 7.1.4