EUVD-2026-90810
GHSA-vc66-6m87-pxh7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running CF7 Apps ≤3.7.2
-
ExploitRequest form page or endpoint
-
ExecutionParse embedded sensitive data from response
-
ImpactHarvest exposed information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | Requires a WordPress site running the WPExperts CF7 Apps plugin (slug contact-form-7-honeypot) at version 3.7.2 or earlier, which in turn depends on Contact Form 7 being installed and at least one form present. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication or user-interaction requirement and it works against default configurations, but exploitation is limited to retrieving the particular sensitive data the plugin embeds into sent data (CWE-201) - the value of exploitation depends entirely on what that site's forms/configuration actually expose. Limiting factor: impact is confidentiality-only and low (C:L), with no state change or service disruption. |
| Impact | This is a modest-severity information disclosure flaw that is a low-to-medium real-world priority despite being unauthenticated. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 MEDIUM) indicates remote, low-complexity, no-authentication, no-interaction exploitation, but impact is confined to a single low-confidentiality exposure (C:L) with no integrity or availability effect - consistent with CWE-201 (Insertion of Sensitive Information Into Sent Data). No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The only intelligence source is a single Patchstack database entry, so corroboration is thin. Net: a genuine but low-impact unauthenticated leak - worth patching routinely, not an emergency. One caveat to verify with the vendor: the CWE-201 label (sensitive data embedded in data sent to a client/recipient, e.g., comments, hidden fields, or email output) is broad, and the exact nature of the exposed data is not specified in the description, so the practical sensitivity should be confirmed against the Patchstack advisory. |
| Exploit ScenarioDerived | An unauthenticated remote attacker interacts with a Contact Form 7 form (or its associated output) on a site running CF7 Apps ≤3.7.2 and retrieves sensitive information that the plugin inadvertently embeds into data it sends - for example, configuration values, honeypot/field metadata, or other secrets exposed in page markup or responses. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network access to the public site with no credentials or user interaction. No public proof-of-concept is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Unauthenticated information disclosure in the WPExperts CF7 Apps WordPress plugin (slug contact-form-7-honeypot) at version 3.7.2 and earlier lets a remote attacker retrieve sensitive data that the plugin inserts into data it sends out, typically form submission payloads or notification content. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required and default configurations are affected, but the flaw is confidentiality-only and low impact (C:L, no integrity or availability effect), so real-world severity depends on what a given site's forms and configuration actually expose. No public exploit identified at time of analysis, and CR7 Apps is not listed as confirmed actively exploited (CISA KEV); the risk is best characterized as a low-to-medium priority information disclosure rather than a critical incident.
RemediationAI
No vendor-released patch version is confirmed in the available data for CVE-2026-62058; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/contact-form-7-honeypot/vulnerability/wordpress-cf7-apps-plugin-3-7-2-sensitive-data-exposure-vulnerability?_s_id=cve) is the authoritative source for the current fixed release of CF7 Apps and should be checked before upgrading, with any update above 3.7.2 treated as the intended fix. Because the plugin is unauthenticated-reachable by design, the most effective immediate compensating control is to deactivate CF7 Apps on any site where it is not essential - the trade-off being loss of its honeypot/spam-filtering capability, which will increase form spam volume - and where it must stay enabled, audit every form's configuration and notification/webhook payloads and strip API keys, tokens, internal notes and unnecessary recipient addresses from any field the plugin forwards, since that content is exactly what CWE-201 leaks. Restrict or block external access to any plugin-specific REST/AJAX endpoint or submission-log page that returns the sent data (via firewall, WAF rule, or web-server allow-listing), accepting that this may break legitimate integrations that consume those endpoints. Additionally, rotate any credentials or tokens that may have been embedded in plugin-generated mail or webhook traffic, monitor web-server and mail logs for anomalous retrieval attempts against plugin paths, and retain a rollback plan because reversing these restrictions later requires re-enabling the plugin's data-forwarding features. Note that upgrading to the fixed version is the only remediation that addresses the root cause rather than reducing reachability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-201 (Insertion of Sensitive Information Into Sent Data), the mirror image of the more familiar CWE-200 data exposure: rather than a storage or access-control bug, the plugin places sensitive values inside an outbound payload that a remote party can subsequently read. CF7 Apps extends Contact Form 7 (contact-form-7-honeypot is the plugin's directory slug), hooking form submission processing to add honeypot and spam-control behavior; the vulnerable path causes data the site considers sensitive to be included in sent data - for example notification emails, webhook/API transmissions, or submission records the plugin exposes - where an unauthenticated network attacker can retrieve it. The CPE cpe:2.3:a:wpexperts:cf7_apps:*:*:*:*:*:*:*:* identifies the affected WordPress plugin distro from WPExperts. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms exploitability without credentials or user action against default settings, while the low confidentiality metric and unchanged scope reflect that only the specific embedded values are exposed and nothing about the server state is modified. Exploitation is conditional on a functioning WordPress installation running the vulnerable plugin version with Contact Form 7 installed and at least one form present, since the disclosure only occurs along a form submission path. Because the value of any retrieved data is site-specific - API keys, tokens, customer PII, internal notes or recipient addresses captured in form configuration - the practical impact ranges from negligible to meaningful depending on the deployment.
Know when Cf7 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network access to a public WordPress form with no interaction yields a single low-confidentiality data leak and no integrity or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB