CVE-2026-120407: medium-severity vulnerability in Contact Form 7
Contact Form 7 < 6.2.5 - Editor+ Sensitive User Data Disclosure via Form Default Values
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.5
The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value can be populated from, allowing users with the Editor role and above to obtain the password hash and sensitive user meta (such as two-factor secrets) of higher-privileged users, including administrators, who view and submit the form.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Affected products
Unknown · Contact Form 7Related CVEs — Contact Form 7
In the same product, most dangerous first.