CVE-2018-20979: Rocklobster Contact Form 7

Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days.

The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.

Affected products

• Rocklobster Contact Form 7: before 5.0.4 (fixed in 5.0.4)

Published 2019-08-22. Last modified 2026-06-17.