Contact Form 7 <= 6.2.4.1 - Unauthenticated Sensitive Information Exposure via Post-Related Special Mail Tags
- ID
- WPSEC-2026-2841
- Plugin
- Contact Form 7 (contact-form-7)
- Affected
- all versions before 6.2.5
- Remediation
- Update to 6.2.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-12
- Attack surface
- Contact Form 7 on WPSec AttackSurface
- Fix released
- Published
Description
The Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure via post-related special mail tags ([_post_id], [_post_name], [_post_title], [_post_url], [_post_author], [_post_author_email]) in all versions up to, and including, 6.2.4.1. This is due to the plugin resolving these tags for whatever post ID the client submits as the form's container post, without checking that the post is publicly viewable and not password-protected. This makes it possible for unauthenticated attackers to obtain the title, slug, permalink and author name and email of private, draft or password-protected posts. To exploit this, the form's mail template must use these tags and the mail must go to an address the attacker controls, such as an auto-reply.
References
- https://wpsec.com/vuln/WPSEC-2026-2841/
- https://plugins.svn.wordpress.org/contact-form-7/tags/6.2.5/
- https://wordpress.org/plugins/contact-form-7/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS