Email Header Injection in Contact Form 7 Mail Additional Headers

Contact Form 7 expanded mail-tags across the entire “Additional headers” mail template in a single pass and appended the result to the outgoing message headers verbatim. A submitted form value containing a line break could therefore inject arbitrary extra headers, allowing a site visitor to add recipients (Bcc/Cc) and relay or covertly copy mail sent through the form. Fixed in 6.1.5 by expanding each header line separately, discarding lines without a colon and truncating every expanded line at the first newline.

This vulnerability affects the following application versions:

• Contact Form 7 3.6
• Contact Form 7 3.7
• Contact Form 7 3.7.1
• Contact Form 7 3.7.2
• Contact Form 7 3.8
• Contact Form 7 3.8.1
• Contact Form 7 3.9
• Contact Form 7 3.9.1
• Contact Form 7 3.9.2
• Contact Form 7 3.9.3
• Contact Form 7 3.9-beta
• Contact Form 7 4.0
• Contact Form 7 4.0.1
• Contact Form 7 4.0.2
• Contact Form 7 4.0.3
• Contact Form 7 4.1
• Contact Form 7 4.1.1
• Contact Form 7 4.1.2
• Contact Form 7 4.1-beta
• Contact Form 7 4.2
• Contact Form 7 4.2.1
• Contact Form 7 4.2.2
• Contact Form 7 4.2-beta
• Contact Form 7 4.3
• Contact Form 7 4.3.1
• Contact Form 7 4.4
• Contact Form 7 4.4.1
• Contact Form 7 4.4.2
• Contact Form 7 4.5
• Contact Form 7 4.5.1
• Contact Form 7 4.6
• Contact Form 7 4.6.1
• Contact Form 7 4.7
• Contact Form 7 4.8
• Contact Form 7 4.8.1
• Contact Form 7 4.9
• Contact Form 7 4.9.1
• Contact Form 7 4.9.2
• Contact Form 7 5.0
• Contact Form 7 5.0.1
• Contact Form 7 5.0.2
• Contact Form 7 5.0.3
• Contact Form 7 5.0.4
• Contact Form 7 5.0.5
• Contact Form 7 5.1
• Contact Form 7 5.1.1
• Contact Form 7 5.1.2
• Contact Form 7 5.1.3
• Contact Form 7 5.1.4
• Contact Form 7 5.1.5
• Contact Form 7 5.1.6
• Contact Form 7 5.1.7
• Contact Form 7 5.1.8
• Contact Form 7 5.1.9
• Contact Form 7 5.2
• Contact Form 7 5.2.1
• Contact Form 7 5.2.2
• Contact Form 7 5.3
• Contact Form 7 5.3.1
• Contact Form 7 5.3.2
• Contact Form 7 5.4
• Contact Form 7 5.4.1
• Contact Form 7 5.4.2
• Contact Form 7 5.5
• Contact Form 7 5.5.1
• Contact Form 7 5.5.2
• Contact Form 7 5.5.3
• Contact Form 7 5.5.4
• Contact Form 7 5.5.5
• Contact Form 7 5.5.6
• Contact Form 7 5.5.6.1
• Contact Form 7 5.6
• Contact Form 7 5.6.1
• Contact Form 7 5.6.2
• Contact Form 7 5.6.3
• Contact Form 7 5.6.4
• Contact Form 7 5.7
• Contact Form 7 5.7.1
• Contact Form 7 5.7.2
• Contact Form 7 5.7.3
• Contact Form 7 5.7.4
• Contact Form 7 5.7.5
• Contact Form 7 5.7.5.1
• Contact Form 7 5.7.6
• Contact Form 7 5.7.7
• Contact Form 7 5.8
• Contact Form 7 5.8.1
• Contact Form 7 5.8.2
• Contact Form 7 5.8.3
• Contact Form 7 5.8.4
• Contact Form 7 5.8.5
• Contact Form 7 5.8.6
• Contact Form 7 5.8.7
• Contact Form 7 5.9
• Contact Form 7 5.9.2
• Contact Form 7 5.9.3
• Contact Form 7 5.9.4
• Contact Form 7 5.9.5
• Contact Form 7 5.9.6
• Contact Form 7 5.9.7
• Contact Form 7 5.9.8
• Contact Form 7 6.0
• Contact Form 7 6.0.1
• Contact Form 7 6.0.2
• Contact Form 7 6.0.3
• Contact Form 7 6.0.4
• Contact Form 7 6.0.5
• Contact Form 7 6.0.6
• Contact Form 7 6.1
• Contact Form 7 6.1.1
• Contact Form 7 6.1.2
• Contact Form 7 6.1.3
• Contact Form 7 6.1.4