Contact Form By Wpforms CVE-2026-25339

The real-world risk of this vulnerability is moderate to elevated despite the absence of published CVSS and EPSS scores. The attack vector is likely network-based (typical for web application plugins), and the exploitation appears to require minimal privileges or user interaction—characteristics that increase practical exploitability. The information disclosure nature (CWE-201) means attackers can passively extract sensitive data without causing system-level impact, making detection difficult. The lack of published CVSS/EPSS metrics suggests this CVE may be recent or still under analysis; however, the involvement of Patchstack (a reputable vulnerability aggregator) and ENISA tracking (EUVD-2026-15649) indicates institutional credibility. Without confirmation of active exploitation (KEV status) or public POC availability, this should be treated as a high-priority patching task for organizations running affected versions, particularly those with sensitive contact form data (e.g., healthcare, financial services).

An attacker discovers a website using the vulnerable Contact Form by WPForms plugin (version ≤ 1.9.8.7) and observes that form submission data—such as names, email addresses, phone numbers, or confidential inquiry details—is embedded in unencrypted or inadequately sanitized HTTP requests or responses. The attacker intercepts form submissions (via network sniffing, man-in-the-middle techniques, or by analyzing cached/logged form data) and extracts the sensitive information without triggering any alerts. If the plugin stores this data insecurely server-side, the attacker may also directly access the database or filesystem to retrieve historical submissions en masse, leading to large-scale information disclosure.