What is CVE-2025-12718?

CVE-2025-12718 is a medium-severity vulnerability in Saadiqbal Quick Contact Form, classified under Improper Input Validation. CVSS score: 5.8/10. Published 2026-01-17.

How severe is CVE-2025-12718?

Medium severity. CVSS v3 base score is 5.8 out of 10.

Improper input validation in Saadiqbal Quick Contact Form

CVE-2025-12718

The Quick Contact Form plugin for WordPress is vulnerable to Open Mail Relay in all versions up to, and including, 8.2.6. This is due to the 'qcf_validate_form' AJAX endpoint allowing a user controlled parameter to set the 'from' email address. This makes it possible for unauthenticated attackers to send emails to arbitrary recipients utilizing the server. The information is limited to the contact form submission details.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.002 (10.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N.

Affected products

Saadiqbal Quick Contact Form — versions 0

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

Frequently asked questions

What is CVE-2025-12718?: CVE-2025-12718 is a medium-severity vulnerability in Saadiqbal Quick Contact Form, classified under Improper Input Validation. CVSS score: 5.8/10. Published 2026-01-17.
How severe is CVE-2025-12718?: Medium severity. CVSS v3 base score is 5.8 out of 10.