# Contact Form 7 Add Password field <= 5.3.0 - Unauthenticated Sensitive Information Exposure via specific_password_check Option

- **ID:** WPSEC-2026-2254
- **Plugin:** Add Password Field for Contact Form 7 (`cf7-add-password-field`), https://wordpress.org/plugins/cf7-add-password-field/
- **Affected versions:** from 3.3 before 5.3.1
- **Fixed in:** 5.3.1 (Update to 5.3.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cf7-add-password-field
- **Fix released:** 2026-11-01
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2254/

## Description

The Add Password Field for Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure via the specific_password_check form-tag option in versions 3.3 up to, and including, 5.3.0, due to the [password] form-tag handler rendering the specific_password_check value, the list of passwords that submissions are checked against, as an HTML attribute of the public input field. This makes it possible for unauthenticated attackers to read the expected passwords from the page source of any form that uses the specific_password_check option and pass the password check it is meant to enforce.

## References

- https://wpsec.com/vuln/WPSEC-2026-2254/
- https://plugins.svn.wordpress.org/cf7-add-password-field/tags/5.3.1/
- https://wordpress.org/plugins/cf7-add-password-field/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2254/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.