CVE-2026-120407
Contact Form 7 < 6.2.5 - Editor+ Sensitive User Data Disclosure via Form Default Values
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value can be populated from, allowing users with the Editor role and above to obtain the password hash and sensitive user meta (such as two-factor secrets) of higher-privileged users, including administrators, who view and submit the form.
| Vendor | unknown |
| Product | contact form 7 |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown contact form 7
Be the first to know when new unknown vulnerabilities affecting unknown contact form 7 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Contact Form 7
0 < 6.2.5
References
Credits
Epihack Bénin WPScan