The vulnerability arises from the ability of the Spam Protect for Contact Form 7 plugin to log request data to a PHP file. When a user with editor privileges sends a specially crafted HTTP header, the log entry is interpreted as executable PHP code, allowing the attacker to run arbitrary commands on the server. This flaw maps to the CWE‑94 code injection weakness and results in a full remote code execution scenario, jeopardizing confidentiality, integrity, and availability of the affected site.

WordPress sites that use the Spam Protect for Contact Form 7 plugin, specifically any installation with a version earlier than 1.2.10. The plugin is not linked to any major vendor, but any WordPress installation deploying it will be vulnerable if that version is in use.

The CVSS score of 7.2 indicates a high impact once bypassed, and with an EPSS of less than 1% the likelihood of public exploitation is currently low. The attack requires the attacker to possess at least editor-level access to the WordPress dashboard or to be able to send crafted POST requests against the plugin endpoint. Because of this requirement, the vulnerability mainly affects sites with many editor users or poorly managed role permissions. No entry in the CISA KEV list means no confirmed large‑scale exploitation so far, but the severity warrants prompt patching.