EUVD-2026-62387
GHSA-c7cx-cp64-87xm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-accessible endpoint returns sensitive geolocation data with no complexity; no integrity or availability impact is present.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions.
AnalysisAI
Sensitive data exposure in the Track Geolocation Of Users Using Contact Form 7 WordPress plugin (versions <= 3.0.2) permits remote unauthenticated attackers to retrieve geolocation records collected from Contact Form 7 form submissions with no credentials or user interaction required. The vulnerability is rooted in CWE-201 - sensitive information returned in responses to unauthorized parties - yielding high confidentiality impact consistent with the CVSS vector (C:H/I:N/A:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the plugin being installed and active on a WordPress site running version 3.0.2 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 High score is fully consistent with the attack surface: the vulnerability is network-accessible, requires no authentication, no special attack complexity, and no user interaction (AV:N/AC:L/PR:N/UI:N), with high confidentiality impact as the primary consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker enumerates WordPress plugins on a target site by requesting the plugin's readme.txt or by scanning for known plugin-specific URL patterns, confirming the presence of the vulnerable Track Geolocation plugin version. The attacker then issues a direct HTTP request to the plugin's unprotected data endpoint - requiring no session cookie, nonce, or WordPress login - and receives a structured response containing stored geolocation records including IP addresses and geographic coordinates of all prior Contact Form 7 submitters. … |
| Remediation | No vendor-released patch version has been independently confirmed in the available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations to identify where Track Geolocation plugin versions 3.0.2 or earlier are deployed and catalog instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today