EUVD-2026-62385
GHSA-4pwf-69q9-4vvg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with plugin installed
-
ExploitSend unauthenticated HTTP request to vulnerable plugin endpoint
-
ExecutionPlugin responds with sensitive data
-
ImpactAttacker collects exposed payment or contact information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | No special conditions are required beyond the target WordPress site having the Pay with Contact Form 7 plugin (version 1.0.4 or earlier) installed and active. The CVSS vector PR:N/UI:N/AC:L confirms exploitation requires no authentication, no user interaction, and no elevated complexity. The primary limiting factor is that the vulnerable site must have this specific plugin installed and network-accessible; WordPress installations with the plugin disabled or removed are not affected. Default WordPress configurations with this plugin active are vulnerable. |
| Impact | The CVSS 7.5 High rating is well-supported by the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N): the attack requires no authentication, no special configuration, and no user interaction, and yields high confidentiality impact. No EPSS score is available in the provided data, and no CISA KEV listing exists, meaning active widespread exploitation is not confirmed - though the simplicity of the attack surface (unauthenticated GET/POST to a WordPress endpoint) implies a low skill threshold for any motivated attacker. No POC exploit has been identified at time of analysis. The scope is limited to WordPress sites running this specific payment-adjacent plugin, which constrains the total vulnerable population; nonetheless, even a mid-sized e-commerce operator in leszno processing customer payments through this form plugin should treat this as an urgent remediation priority given the complete absence of any authentication barrier protecting potentially sensitive financial or personal data. |
| Exploit ScenarioDerived | An unauthenticated attacker enumerates a target WordPress site, detects the presence of the Pay with Contact Form 7 plugin (e.g., via plugin-specific asset paths), then sends a crafted HTTP request to the vulnerable endpoint - requiring no credentials or cookies - and receives a response containing sensitive data such as payment transaction records or personal contact submissions. No public exploit code has been identified at time of analysis, but the low complexity of the attack vector makes manual exploitation straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Unauthenticated sensitive data exposure in the CMSMinds Pay with Contact Form 7 WordPress plugin (versions through 1.0.4) allows remote, unauthenticated attackers to retrieve sensitive information - likely payment-related or personal contact data - without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms a fully network-accessible attack path requiring zero privileges, yielding high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis.
RemediationAI
The primary remediation is to update the Pay with Contact Form 7 plugin to a version beyond 1.0.4; however, the available reference data does not specify an exact patched version number - administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/pay-with-contact-form-7/vulnerability/wordpress-pay-with-contact-form-7-plugin-1-0-4-sensitive-data-exposure-vulnerability and the WordPress plugin repository for the latest release. If no patched version is yet available, the immediate compensating control is to deactivate and remove the plugin entirely, which eliminates the exposed endpoint. A secondary mitigation is to restrict access to the WordPress installation's sensitive endpoints using server-level access controls (e.g., Apache/nginx rules blocking unauthenticated access to specific plugin REST routes or admin-ajax handlers), though this requires identifying the exact vulnerable endpoint and may affect legitimate plugin functionality. Note: no patch version has been independently confirmed from the available input data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is the 'Pay with Contact Form 7' plugin by CMSMinds for WordPress (CPE: cpe:2.3:a:cmsminds:pay_with_contact_form_7:*:*:*:*:*:*:*:*), which extends the popular Contact Form 7 plugin to support payment collection directly within forms. CWE-201 ('Insertion of Sensitive Information Into Sent Data') indicates the root cause is the plugin inadvertently including sensitive data - such as payment credentials, transaction details, or personally identifiable contact information - in an HTTP response or API output that is accessible without authentication. This class of flaw typically arises when an endpoint intended for administrative or internal use lacks proper access controls, or when debug/verbose output containing sensitive fields is exposed to unauthenticated callers.
Know when Pay With Contact Form 7 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible endpoint exposes sensitive data with no authentication, interaction, or complexity required; only confidentiality is impacted.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.
Executive ViewAI
The CMSMinds Pay with Contact Form 7 WordPress plugin (versions through 1.0.4) permits unauthenticated remote attackers to access payment and customer contact data without credentials, creating direct exposure of sensitive financial records. Any organization running affected plugin versions exposes customer data to unauthorized disclosure, triggering potential PCI-DSS violations and reputational harm. Immediate remediation is required.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) immediately disable/remove the plugin from all WordPress installations; (2) deploy WAF rules to block HTTP requests to vulnerable payment data endpoints; (3) restrict network access to WordPress administrative interfaces and payment information storage; (4) enable comprehensive database query logging and alerting on payment data access; (5) contact CMSMinds vendor requesting urgent security update timeline; (6) prepare customer notification and incident response procedures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB