{
 "id": "WPSEC-2026-2841",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2841/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2841/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2841/index.md",
 "title": "Contact Form 7 <= 6.2.4.1 - Unauthenticated Sensitive Information Exposure via Post-Related Special Mail Tags",
 "description": "The Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure via post-related special mail tags ([_post_id], [_post_name], [_post_title], [_post_url], [_post_author], [_post_author_email]) in all versions up to, and including, 6.2.4.1. This is due to the plugin resolving these tags for whatever post ID the client submits as the form's container post, without checking that the post is publicly viewable and not password-protected. This makes it possible for unauthenticated attackers to obtain the title, slug, permalink and author name and email of private, draft or password-protected posts. To exploit this, the form's mail template must use these tags and the mail must go to an address the attacker controls, such as an auto-reply.",
 "plugin": {
  "slug": "contact-form-7",
  "name": "Contact Form 7",
  "full_name": "Contact Form 7",
  "wordpress_org": "https://wordpress.org/plugins/contact-form-7/",
  "advisories_url": "https://wpsec.com/vuln/plugin/contact-form-7/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/contact-form-7"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.2.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.2.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.2.5",
 "remediation": "Update to 6.2.5 or later.",
 "fix_released": "2026-11-10T05:46:56+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:04:12.314843+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2841/",
  "https://plugins.svn.wordpress.org/contact-form-7/tags/6.2.5/",
  "https://wordpress.org/plugins/contact-form-7/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/contact-form-7",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-12"
 }
}