CVE-2025-12718 affects the Quick Contact Form plugin for WordPress, where improper input validation in the 'qcf_validate_form' AJAX endpoint allows an attacker to specify the 'from' email address arbitrarily. This results in an open mail relay vulnerability, enabling unauthenticated attackers to send emails through the server to arbitrary recipients. The vulnerability is present in all versions up to and including 8.2.6. The CVSS 3.1 base score is 5.8, reflecting medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity (email misuse). No patch or official fix has been documented in the provided data.

The vulnerability allows unauthenticated attackers to misuse the affected server as an open mail relay, potentially facilitating spam or phishing campaigns by sending emails with arbitrary 'from' addresses. There is no direct impact on confidentiality or availability, but the integrity of email communications can be compromised. This misuse could affect the reputation of the hosting server and lead to blacklisting by email providers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or restricting access to the 'qcf_validate_form' AJAX endpoint or implementing server-level email sending restrictions to prevent unauthorized relay. Monitoring outgoing email traffic for unusual patterns may help detect exploitation attempts.