# Contact Form 7 <= 6.2.4.1 - Unauthenticated Sensitive Information Exposure via Post-Related Special Mail Tags

- **ID:** WPSEC-2026-2841
- **Plugin:** Contact Form 7 (`contact-form-7`), https://wordpress.org/plugins/contact-form-7/
- **Affected versions:** all versions before 6.2.5
- **Fixed in:** 6.2.5 (Update to 6.2.5 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/contact-form-7
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2841/

## Description

The Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure via post-related special mail tags ([_post_id], [_post_name], [_post_title], [_post_url], [_post_author], [_post_author_email]) in all versions up to, and including, 6.2.4.1. This is due to the plugin resolving these tags for whatever post ID the client submits as the form's container post, without checking that the post is publicly viewable and not password-protected. This makes it possible for unauthenticated attackers to obtain the title, slug, permalink and author name and email of private, draft or password-protected posts. To exploit this, the form's mail template must use these tags and the mail must go to an address the attacker controls, such as an auto-reply.

## References

- https://wpsec.com/vuln/WPSEC-2026-2841/
- https://plugins.svn.wordpress.org/contact-form-7/tags/6.2.5/
- https://wordpress.org/plugins/contact-form-7/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2841/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.