EUVD-2026-96473
GHSA-rv7w-735h-fpxv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site over network
-
ExploitQuery vulnerable Dynamic Text Extension endpoint
-
ImpactRetrieve improperly exposed sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | Requires the Contact Form 7 - Dynamic Text Extension plugin (by sevenspark) installed and active on a WordPress site at version 5.0.7 or earlier; the vulnerable dynamic-text functionality must be reachable. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, user-interaction, or special-configuration barrier beyond having the affected plugin version present, so any internet-facing site running the vulnerable extension is exposed. The limiting factors are plugin presence/version and whatever sensitive data the site's dynamic-text fields actually render; sites not using this specific add-on are unaffected. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact and no integrity or availability effect - consistent with CWE-201 sensitive data exposure. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided, so exploitation-likelihood and automatability signals cannot be weighed; the only exploitation evidence is a single Patchstack advisory. This is a genuine confidentiality concern because exploitation needs no privileges or user interaction, but in the absence of an EPSS probability or KEV/POC confirmation it should be treated as a credible-but-unproven-in-the-wild priority rather than an actively exploited emergency. The high CVSS is driven entirely by ease of access plus C:H; the real-world impact hinges on what sensitive data a given site's Dynamic Text Extension fields actually expose, which the terse description does not specify - verify the concrete data exposed against your own form configurations. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker interacts with a WordPress site running Contact Form 7 with the Dynamic Text Extension plugin at version 5.0.7 or earlier and retrieves sensitive information that the dynamic-text feature improperly exposes. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the request requires no login, no user interaction, and minimal effort. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated sensitive data exposure in the Contact Form 7 - Dynamic Text Extension WordPress plugin (versions up to and including 5.0.7) lets any remote visitor cause the plugin's dynamic-text rendering to return information that was not meant to be disclosed, with high confidentiality impact and no integrity or availability effect (assessed CVSS 3.1 base 7.5). The assessed vector AV:N/AC:L/PR:N/UI:N means no authentication, user interaction, or special configuration is required beyond having the vulnerable plugin installed, active, and reachable on an internet-facing site. Risk is bounded by plugin presence and by whatever sensitive values a site's dynamic-text fields actually render; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch was identified in the available data at time of analysis, so the primary action is to check the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/contact-form-7-dynamic-text-extension/vulnerability/wordpress-contact-form-7-dynamic-text-extension-plugin-5-0-7-sensitive-data-exposure-vulnerability?_s_id=cve for a fixed version and upgrade the plugin as soon as one is published, since this is unauthenticated and requires no interaction to trigger. Until a fix is available, the most effective compensating control is to deactivate and remove the Dynamic Text Extension if it is not business-critical (side effect: any form field relying on dynamic text substitution will stop populating), or, where it must stay enabled, audit every dynamic-text field and remove references to sensitive sources such as user meta, email addresses, tokens, or private post data so there is nothing worth leaking. Additional hardening includes restricting reachability of the affected form pages with a WAF or reverse-proxy rule, or placing pages that use dynamic-text shortcodes behind authentication (trade-off: public contact forms stop working for anonymous visitors), and reviewing server and CDN logs for anomalous requests to those pages to estimate whether data was harvested before the plugin is patched or removed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is a WordPress add-on for Contact Form 7, the widely deployed form plugin, that substitutes dynamically generated values into form fields via shortcodes. The weakness maps to CWE-201 (Insertion of Sensitive Information Into Sent Data): instead of a memory-safety or injection bug, the flaw is that the plugin includes sensitive data in the output it sends to the client, where an unauthenticated request can retrieve it. The CPE cpe:2.3:a:sevenspark:contact_form_7_-_dynamic_text_extension:*:*:*:*:*:*:*:* identifies the vendor as sevenspark and treats all versions as in scope up to the 5.0.7 fix threshold noted in the advisory. Because the CVSS vector carries PR:N and UI:N, the exposure path is a plain network request rather than an authenticated administrative action, which is consistent with the reported Patchstack classification of Information Disclosure within the WordPress plugin ecosystem, where unauthenticated endpoints that echo stored or generated values are a recurring data-leak pattern.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable data exposure needing no interaction gives AV:N/AC:L/PR:N/UI:N; confidentiality-only impact sets C:H, I:N, A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in Contact Form 7 - Dynamic Text Extension <= 5.0.7 versions.
Executive ViewAI
An unauthenticated sensitive-data exposure flaw in the Contact Form 7 - Dynamic Text Extension WordPress plugin (all versions through 5.0.7) allows any anonymous internet visitor to trigger the plugin's dynamic-text rendering and retrieve information the site never intended to disclose, with no login or user interaction required. Because this plugin is widely deployed on public-facing WordPress sites run by marketing, HR, and business teams, any organization hosting it may be exposing form-derived or configuration data that could include customer details, internal references, or other confidential values rendered into dynamic fields. Leadership should care because remediation is not yet available from the vendor, meaning exposure persists until the plugin is removed, disabled, or otherwise contained.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall the Contact Form 7 - Dynamic Text Extension plugin (versions up to and including 5.0.7) where it is not required; restrict anonymous access to affected plugin endpoints via authentication, IP allowlisting, or WAF rules; audit and purge sensitive values from dynamic-text field configurations; and monitor web logs for anomalous requests to the plugin.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB