- Current version
- 6.1.6
- Active installations
- 5 million+
- WordPress.org status
- Active
- Known vulnerabilities
- A handful, historically
- Open unresolved
- 0
- Last vulnerability
- Addressed in a 6.1.x maintenance release
- PHP compatibility
- PHP 7.4+ supported
- Maintenance frequency
- Active — regular releases, tested against current WordPress
Data reviewed August 2026. Version numbers move weekly — the WordPress.org listing linked in the sidebar is always authoritative for the current release.
Current security status
Contact Form 7 is one of the oldest and most widely installed plugins in WordPress, with over five million active installations. It is actively maintained, the current release line is 6.1.x, and there are no known unresolved vulnerabilities. WPDeeply rates it LOW risk.
Why LOW
- A narrow, stable feature set — it builds forms and sends mail, and has resisted scope creep for over a decade.
- A consistent release cadence, including security fixes shipped in ordinary minor releases and clearly noted as such.
- Its historical findings have been limited in scope and promptly patched.
Where the risk sits with CF7
Almost entirely in add-ons and configuration rather than the plugin itself. The third-party CF7 extension ecosystem is large and uneven — a widely used dynamic-text extension had an unauthenticated shortcode-execution issue in the past, and that pattern repeats across smaller add-ons.
- If you use the file-upload feature, restrict accepted types and make sure PHP cannot execute in your uploads directory.
- Add spam protection — CF7 is the most heavily targeted form plugin in WordPress, and spam volume is an operational problem before it is a security one.
- Audit every CF7 add-on separately.
Recommendation
Keep it. It is a good example of a plugin whose long life and boring feature set are security assets rather than warning signs.