CVE-2026-25863 describes an uncontrolled resource consumption vulnerability in the Conditional Fields for Contact Form 7 plugin for WordPress, specifically in versions up to 2.7.2. The issue arises in the Wpcf7cfMailParser class where the hide_hidden_mail_fields_regex_callback() method reads an iteration count directly from user-supplied POST parameters without validation or upper bound enforcement. An unauthenticated attacker can exploit this by supplying an arbitrarily large integer via the REST API endpoint, causing multiple preg_replace() operations to execute in an unbounded loop. This results in server memory exhaustion and a crash of the PHP process hosting the plugin.

Successful exploitation allows unauthenticated attackers to cause a denial of service by exhausting server memory and crashing the PHP process running the WordPress plugin. This disrupts availability of the affected web application. There is no indication of data disclosure or privilege escalation from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the vulnerable REST API endpoint or implementing web application firewall rules to limit or block suspicious requests with large iteration counts. Monitor for unusual resource consumption patterns related to this plugin.