CF7 Geolocation Plugin CVE-2026-73386

No special conditions are required beyond the plugin being installed and active on a WordPress site running version 3.0.2 or earlier. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against any WordPress deployment with this plugin present, with no requirement for a specific server configuration, non-default setting, or administrative action. The practical limiting factor is that geolocation data must have been collected - meaning at least one Contact Form 7 form submission must have been processed by the plugin - for there to be sensitive data to exfiltrate; a freshly installed but unused plugin would expose an empty dataset. There is no platform, WordPress version, or hosting environment constraint identified in the available data.

The CVSS 7.5 High score is fully consistent with the attack surface: the vulnerability is network-accessible, requires no authentication, no special attack complexity, and no user interaction (AV:N/AC:L/PR:N/UI:N), with high confidentiality impact as the primary consequence. No EPSS score was supplied in the available intelligence, limiting probabilistic exploitation forecasting beyond what the CVSS vector implies. The absence of a CISA KEV listing and the lack of confirmed public exploit code suggest this has not yet been broadly weaponized; however, the near-zero exploitation prerequisites mean that time-to-exploit after any PoC publication would be minimal - even a mid-sized municipal IT team in inowroclaw running public-facing WordPress sites would face rapid opportunistic scanning once exploitation details circulate. The most significant real-world risk dimension beyond raw CVSS severity is the privacy and regulatory exposure: geolocation data tied to form submitters qualifies as personal data under GDPR and similar frameworks, meaning unauthorized access could trigger breach notification obligations independent of technical severity. SSVC signals are inferred rather than formally assessed given the absence of KEV status and EPSS data.

An unauthenticated attacker enumerates WordPress plugins on a target site by requesting the plugin's readme.txt or by scanning for known plugin-specific URL patterns, confirming the presence of the vulnerable Track Geolocation plugin version. The attacker then issues a direct HTTP request to the plugin's unprotected data endpoint - requiring no session cookie, nonce, or WordPress login - and receives a structured response containing stored geolocation records including IP addresses and geographic coordinates of all prior Contact Form 7 submitters. No public exploit code has been confirmed at time of analysis, but the straightforward nature of the attack requires no specialized tooling beyond a standard HTTP client.