Description

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T13:18:07.650Z",
  "pubdate": "2026-08-19T13:18:07.650Z",
  "executiveSummary": "An unauthenticated sensitive data exposure vulnerability has been identified in the Pay with Contact Form 7 plugin, specifically affecting versions 1.0.4 and prior. This security flaw allows unauthenticated remote attackers to access confidential information processed or stored by the plugin without requiring any prior authorization, valid sessions, or elevated privileges.\nThe primary risk associated with this vulnerability involves the unauthorized retrieval of sensitive data, which may encompass personally identifiable information, transactional records, or internal configuration details handled by Contact Form 7 submissions integrated with payment processing workflows.\nThe impact on affected systems is significant, as successful exploitation circumvents core access control mechanisms deployed within the application layer. Attackers possess the capability to harvest exposed data programmatically over the network, potentially leading to widespread privacy violations, compliance failures, and secondary downstream attacks utilizing harvested intelligence.\nExploitation requirements are minimal, as the attack vector is exposed via network protocols and does not necessitate interaction from authenticated users or administrators. Remediating this exposure requires immediate vendor-supplied updates or application-level access restrictions targeting the vulnerable component.",
  "technicalDetails": "The root cause of the vulnerability stems from improper access control enforcement within the Pay with Contact Form 7 plugin for versions <= 1.0.4. The affected component fails to validate whether incoming HTTP requests originate from authenticated users possessing appropriate privileges before serving sensitive responses.\nThe vulnerable component lacks robust authorization checks on endpoints or functions responsible for handling data retrieval operations associated with form submissions and payment processing states. Consequently, any remote attacker capable of routing network traffic to the target web application can issue crafted requests and elicit responses containing unmasked sensitive data.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies the accessible endpoint exposed by the Pay with Contact Form 7 plugin. Second, the attacker constructs an HTTP request targeting the vulnerable function without supplying session cookies, authentication tokens, or API keys. Third, due to the absence of input validation and rigorous authorization checks, the backend processing logic queries the database or internal storage mechanisms for the requested submission records.\nFinally, the application serializes and returns the sensitive data directly in the HTTP response body to the unauthenticated client. Network exposure is strictly remote over standard web protocols (HTTP/HTTPS), allowing automated scanners and custom scripts to harvest data at scale.\nPrivilege requirements are nonexistent, as the vulnerability is exploitable by anonymous users interacting directly with the public-facing web server interface. Post-exploitation impact encompasses the complete compromise of confidentiality for data processed via the affected plugin, enabling malicious actors to accumulate sensitive user inputs, payment metadata, and potentially internal system identifiers without triggering standard application audit logs."
}