---
title: "Flamingo"
description: "Flamingo for Contact Form 7: who it helps, its limits (no message purge, GDPR), the settings we recommend and its patched vulnerabilities."
language: "en"
locale: "en-US"
type: "plugin-sheet"
canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/flamingo/"
published: "2026-11-04T08:00:00+00:00"
modified: "2026-11-05T21:07:57+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/flamingo/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/flamingo/index.md"
  es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/flamingo/index.md"
  de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/flamingo/index.md"
  it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/flamingo/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/flamingo/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/flamingo/index.md"
---

# Flamingo

Flamingo saves a copy of every Contact Form 7 submission inside WordPress, even when the notification email fails. This sheet covers who it helps, its real limitations (retention, privacy), the settings to apply in your forms and its patched vulnerabilities.

## The essentials

- Best for keeping a copy of Contact Form 7 messages, even when the notification email fails.
- Main caveat: real messages are never purged automatically, so you must delete them yourself.
- Free, with no paid edition, just like Contact Form 7, which it relies on.

## What Flamingo does on your site

Flamingo is the message storage plugin built for [Contact Form 7](https://www.wp-masquerade.com/features/camouflaged-plugins/contact-form-7/), which keeps nothing in the database on its own. It comes from the same developer, Rock Lobster Inc., Takayuki Miyoshi’s company, and it is completely free, with no paid edition. There is nothing to configure: as soon as you activate it, Contact Form 7 detects it and hands it a copy of every submission.

Each message is saved as private content, with the submitted fields, any consent collected, the reCAPTCHA result and metadata such as the IP address, browser and source page. Flamingo also keeps submissions flagged as spam and those whose email failed to send, which is the whole point when the mail server is misconfigured. Attachments are not kept, because Contact Form 7 deletes them after sending.

The plugin adds a Flamingo menu with two screens: Inbound Messages, grouped by channel (one channel per form), and Address Book, which collects senders. The address book also fills itself with user accounts and the authors of approved comments. Flamingo loads no script or stylesheet for visitors: everything happens in the admin area.

![Diagram: Flamingo works on visitors and bots, wordpress, external services. Public traces: no known public trace.](https://www.wp-masquerade.com/media/wpm-sheets/flamingo/diagram-en.svg?v=214a92bd)

## Which sites Flamingo is a good fit for

- **Sites already running Contact Form 7** that can’t afford to lose a quote request when an email goes missing.
- **Small businesses** that want to search old messages, or export a form’s submissions to CSV for a spreadsheet.
- **Agencies** that need a record of submissions to troubleshoot a client’s email deliverability.

It’s the wrong choice if your forms come from another plugin (Flamingo was designed for Contact Form 7), if you want to reply to messages or assign them to a team inside WordPress, or if you’d rather not keep personal data on the server at all. In that last case, focus on making email delivery reliable instead.

## Flamingo strengths and limitations

### Strengths

- **Zero setup.** Just activate it: Contact Form 7, from the same developer, feeds it automatically.
- **A real safety net.** Submissions whose email failed and spam are kept, so you can recover them.
- **Safer CSV export.** A cell that starts like a spreadsheet formula gets a warning prefix instead of running.
- **Admins only.** The screens require the capability to edit users, and nothing loads on the front end.
- **Works with Akismet and privacy tools.** Marking a message as spam reports it to Akismet, and the WordPress personal data eraser covers Flamingo.

### Limitations

- **No retention period.** Only spam goes to the trash after 30 days; real messages stay until you delete them.
- **No replies or tracking.** It’s a searchable archive, not a ticketing tool: no replies, statuses or assignments.
- **No privacy exporter.** The plugin registers with the WordPress data eraser, but not with the personal data export tool.
- **Data survives deletion.** There is no uninstall routine: messages and contacts stay in the database.
- **Access can’t be delegated without code.** Giving an editor access to messages takes the `flamingo_map_meta_cap` PHP filter.

## The Flamingo settings we recommend

Flamingo has no settings screen. You control it from each Contact Form 7 form (Additional Settings tab), with a constant in `wp-config.php`, and through your own cleanup routine.

| Setting | Recommended value | Why |
| --- | --- | --- |
| **Forms not to store**  Contact > Contact Forms > Additional Settings tab | `do_not_store: true` on forms whose submissions you don’t need to keep | Less personal data stored means less to protect and purge. |
| **Consent to storage**  Form tab | A checkbox such as `[acceptance storage optional consent_for:storage]` if you want to let visitors choose | If the box is left unchecked, Contact Form 7 doesn’t pass the message to Flamingo. |
| **Name, email and subject**  Additional Settings tab | `flamingo_email: "[contact-email]"`, plus `flamingo_name` and `flamingo_subject`, if your fields aren’t named `your-email`, `your-name` and `your-subject` | Otherwise the From and Subject columns stay empty and the address book doesn’t fill up. |
| **Spam cleanup**  `wp-config.php`, `FLAMINGO_MOVE_TRASH_DAYS` constant | Default (30), or lower on a site that gets heavy spam | An hourly scheduled task trashes older spam; setting it to 0 turns the cleanup off. |
| **Message retention**  Flamingo > Inbound Messages | Regular cleanup (Move to trash bulk action, then Empty trash) matching the period stated in your privacy policy | Nothing is deleted automatically; a stated retention period means nothing without a purge. |
| **Spam triage**  Flamingo > Inbound Messages | Mark as spam and Not spam actions rather than plain deletion | When Akismet checked the message, Flamingo sends it your correction. |
| **Erasure requests**  Tools > Erase Personal Data | The WordPress tool, which covers the Address Book and Inbound Messages | One request also erases Flamingo data tied to that email address. |
| **Updates**  Plugins > Installed Plugins | Auto-updates on, version 2.6.3 or later | It fixes a leak of channel names to contributors (see below). |

- Send a test message and check that it shows up under Flamingo > Inbound Messages, with sender and subject filled in.
- Log in with an editor or contributor account and confirm the Flamingo menu doesn’t appear.
- State in your privacy policy that messages, IP addresses and browser details are stored, and for how long.
- If an email never arrived but the message is in Flamingo, fix delivery with an SMTP plugin such as [WP Mail SMTP](https://www.wp-masquerade.com/features/camouflaged-plugins/wp-mail-smtp/).

To stop human spammers earlier, pair Contact Form 7 with [Akismet](https://www.wp-masquerade.com/features/camouflaged-plugins/akismet/). Retention periods and how to treat IP addresses are covered in our article on activity logs and GDPR.

## Flamingo’s patched vulnerabilities

Flamingo has had few vulnerabilities, all rated medium by Patchstack. In early 2020, version 2.1.1 fixed a CSV injection: a visitor could slip a formula into a field that would run when the export was opened in a spreadsheet. That is where the warning on suspicious cells comes from, and version 2.6.2 hardened it.

In September 2026, CVE-2026-12853 (CVSS 4.3) was published for versions 2.6.2 and earlier: a contributor account could list, through [XML-RPC](https://www.wp-masquerade.com/glossary/xml-rpc/) or a WordPress AJAX request, the channel names (that is, your form titles), the message count per channel and the address book tags. Version 2.6.3 gives Flamingo’s content types their own capabilities. Message contents were not exposed.

The practical step is still auto-updates (see our guide to automatic plugin updates), plus keeping unneeded contributor accounts to a minimum. WP Masquerade Pro supports Flamingo, but the box below lists no trace for it to remove from your pages, so updating remains the real protection.

## Flamingo FAQ

**Does Flamingo recover messages sent before it was installed?**

No. Contact Form 7 keeps no copy of submissions, so Flamingo only records messages received after it is activated.

**Where are the messages stored?**

In the WordPress database, as private content of type `flamingo_inbound` for messages and `flamingo_contact` for the address book. They end up in your database backups, which need protecting accordingly.

**Does Flamingo work with other form plugins?**

It was designed for Contact Form 7, which contains the code that saves submissions. Other form plugins usually have their own entry storage.

**Does uninstalling Flamingo delete the messages?**

No, the plugin has no uninstall routine. Empty Inbound Messages and the Address Book before deleting it if you no longer want to keep that data.

**Why does the address book list people who never wrote to me?**

Flamingo also adds user accounts and authors of approved comments, at activation and then with each new account or comment. Delete the contacts you don’t need if you only want to keep senders.

## Key facts

- Category: Forms
- Vendor: Rock Lobster Inc.
- Price: Free, with no paid edition
- Active installations (wordpress.org): 800 000+
- Version: 2.6.4
- Official page: https://wordpress.org/plugins/flamingo/

## What WP Masquerade hides

- Handled by WP Masquerade Pro only