Vulnerabilities / Contact Form 7 Add Password field / WPSEC-2026-2254
Contact Form 7 Add Password field <= 5.3.0 - Unauthenticated Sensitive Information Exposure via specific_password_check Option
Medium 5.3
CWE-200Fixed in 5.3.1
- ID
- WPSEC-2026-2254
- Plugin
- Add Password Field for Contact Form 7 (cf7-add-password-field)
- Affected
- from 3.3 before 5.3.1
- Remediation
- Update to 5.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Contact Form 7 Add Password field on WPSec AttackSurface
- Fix released
- Published
Description
The Add Password Field for Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure via the specific_password_check form-tag option in versions 3.3 up to, and including, 5.3.0, due to the [password] form-tag handler rendering the specific_password_check value, the list of passwords that submissions are checked against, as an HTML attribute of the public input field. This makes it possible for unauthenticated attackers to read the expected passwords from the page source of any form that uses the specific_password_check option and pass the password check it is meant to enforce.
References
- https://wpsec.com/vuln/WPSEC-2026-2254/
- https://plugins.svn.wordpress.org/cf7-add-password-field/tags/5.3.1/
- https://wordpress.org/plugins/cf7-add-password-field/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS