Cf7 Apps
Monthly
Unauthenticated information disclosure in the WPExperts CF7 Apps WordPress plugin (slug contact-form-7-honeypot) at version 3.7.2 and earlier lets a remote attacker retrieve sensitive data that the plugin inserts into data it sends out, typically form submission payloads or notification content. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required and default configurations are affected, but the flaw is confidentiality-only and low impact (C:L, no integrity or availability effect), so real-world severity depends on what a given site's forms and configuration actually expose. No public exploit identified at time of analysis, and CR7 Apps is not listed as confirmed actively exploited (CISA KEV); the risk is best characterized as a low-to-medium priority information disclosure rather than a critical incident.
Unauthenticated information disclosure in the WPExperts CF7 Apps WordPress plugin (slug contact-form-7-honeypot) at version 3.7.2 and earlier lets a remote attacker retrieve sensitive data that the plugin inserts into data it sends out, typically form submission payloads or notification content. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required and default configurations are affected, but the flaw is confidentiality-only and low impact (C:L, no integrity or availability effect), so real-world severity depends on what a given site's forms and configuration actually expose. No public exploit identified at time of analysis, and CR7 Apps is not listed as confirmed actively exploited (CISA KEV); the risk is best characterized as a low-to-medium priority information disclosure rather than a critical incident.