If your business website runs on WordPress, there's a good chance a contact form plugin is doing some of your most important work: taking quote requests, job applications and customer questions. This week, two of the most popular form plugins put out security fixes. Here's what happened, in plain English, and what I'd check.
What happened
Contact Form 7. On October 29, the developer released Contact Form 7 version 6.2.4 with several security fixes. Contact Form 7 is active on more than 10 million WordPress sites, so this one reaches a lot of businesses.
The problem only affects versions 6.2 through 6.2.3, which came out between October 6 and October 21. According to the developer, someone who isn't logged in could combine several small flaws to upload files the form should block, and keep files that should be deleted right after the form is sent. It only matters for forms with a file upload field, like an "attach your resume" or "send us a photo" box.
The developer says sites are most exposed when the server is set up to show a public list of the files in a folder. Patchstack, a WordPress security firm, rates the issue 8.1 out of 10 and notes that uploaded files land in a randomly named folder, which makes an attack harder but not impossible.
Gravity Forms. Also on October 29, security researchers published a critical flaw in Gravity Forms, rated 9.8 out of 10, tracked as CVE-2026-103039. It affects version 3.1.2 and earlier, and no login is needed to try it.
The good news is the risk is narrow. It only applies to forms that create WordPress posts and use a "Post Custom Field" set to the List type. Most simple contact forms don't do that. But if yours does, an attacker could plant harmful data through the form, and on some server setups that can lead to running their own code on your site. The same batch of disclosures also listed two other no-login flaws in the same version range that let attackers sneak scripts into form entries.
The fix, version 3.1.3, actually shipped back on October 1, and the current release is 3.2.1. So if your site has been getting regular updates, you may already be covered. Patchstack warns that flaws like this are expected to be exploited and used in mass attacks that hit thousands of sites at once, no matter how big or small.
Why this matters for your business
Your forms are where leads come in. A hacked form can turn into a hacked website, and a broken form means quote requests quietly stop arriving. Both are bad, and you often don't notice until a customer calls to ask why you never wrote back.
There's also a catch with the Contact Form 7 update that's worth knowing before you click the button. To tighten security, version 6.2.4 now only accepts a short list of file types as-is: images, audio, video, PDF and plain text. Other attachments, like Word or Excel files, get their file extension changed to a safe one. If your job application or quote form asks people to attach a Word document, those files may arrive looking odd. Your developer can add the file types you need with a small setting that Contact Form 7 documents.
And one more: the Contact Form 7 6.2 series requires WordPress 7.1 or higher and PHP 8.3 or higher. If your site is on an older setup, it can't take this update at all. That doesn't mean you're affected by this flaw, since it only exists in 6.2 to 6.2.3, but it does mean your site is falling behind on updates.
What I'd do this week
- Check which form plugin you use, and its version. In WordPress, go to Plugins and look for Contact Form 7 or Gravity Forms.
- Contact Form 7 on 6.2 to 6.2.3? Update to the latest version (6.2.4.1 right now). After updating, send yourself a test from every form, including one with an attachment.
- Gravity Forms on 3.1.2 or earlier? Update to 3.2.1, or at least 3.1.3. If the update isn't showing, check that your Gravity Forms license is active.
- Ask your host or developer to turn off public folder listings. This is a simple server setting, and it closes the easy path for the Contact Form 7 flaw.
- If you can't update right away, temporarily remove file upload fields, or turn off any Gravity Forms form that creates posts, until you can.
- Keep a recent backup before you update anything.
If you're lost, we can help
If you're not sure which form plugin your site uses, or you're nervous about breaking something by updating, that's normal. HDM has been building and caring for websites out of Springboro, Ohio for 20 years. Send us a request and we'll check your forms and tell you plainly what we find, or call us at (513) 668-7344.
