Contact forms are the digital equivalent of a welcome mat — you want people to step on it, not use it to pry open your front door. This week, Drupal's security team found out one of the platform's most popular form-building modules had been leaving the door ajar in twenty different ways at once.

Twenty Advisories, One Very Busy Wednesday

On September 23, 2026, the Drupal Security Team published 36 advisories covering 16 contributed projects — and 20 of them, more than half, were about a single module: Webform. Drupal core itself came away clean.

The scariest one, SA-CONTRIB-2026-175, scored 18 out of 25 and can lead to full remote code execution on sites using custom submission formats that contain tokens. Affected sites should update to Webform 6.2.12 or 6.3.1 immediately — and that's before you even get to the bundled file upload, JSON:API, and anti-spam issues in the same release.

Why a Form Plugin Can Sink a Whole Site

Webform is one of the most widely installed modules in the Drupal ecosystem, which means this isn't some obscure add-on nobody uses — it's the thing collecting your newsletter signups, job applications, and support tickets. Remote code execution via a contact form is about as unglamorous an attack vector as it gets, and that's exactly why it works.

The detail most headlines will skip: severity here is configuration-dependent. A "Critical" rating doesn't mean every Webform install is instantly compromised, but it does mean you need to actually check your token usage and permissions rather than assume "Critical" is just marketing language on a security page.

Moral of the story: the scariest vulnerabilities rarely look like sci-fi hacking — they look like a form nobody's patched since Q2.

If you're not sure whether your Drupal site's forms and modules are sitting on any of these twenty advisories, that's the kind of audit the WTK team runs all day — get in touch and we'll check before someone else does.

Source: The DropTimes