CVE-2024-3870 Contact Form 7 Database Addon – CFDB7 <= 1.2.6.8 - Unauthenticated Sensitive Information Exposure

🗓️ 02 May 2024 16:52:26Reported by WordfenceType

WordPress plugin vulnerability in CFDB7 plugin

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	The vulnerability of the cfdb7_before_send_mail() function in the Contact Form 7 Database Addon (CFDB7), a content management system for WordPress websites. This vulnerability allows attackers to gain unauthorized access to protected information.	30 Apr 202400:00	–	bdu_fstec
CNNVD	WordPress plugin CFDB7 安全漏洞	2 May 202400:00	–	cnnvd
CVE	CVE-2024-3870	2 May 202416:52	–	cve
EUVD	EUVD-2024-32438	3 Oct 202520:07	–	euvd
NVD	CVE-2024-3870	2 May 202417:15	–	nvd
Patchstack	WordPress Contact Form 7 Database Addon – CFDB7 Plugin <= 1.2.6.8 is vulnerable to Sensitive Data Exposure	29 Apr 202400:00	–	patchstack
Patchstack	WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.6.8 - Unauthenticated Sensitive Information Exposure vulnerability	29 Apr 202411:50	–	patchstack
Positive Technologies	PT-2024-3151 · WordPress · Contact Form 7 Database Addon – Cfdb7	16 Apr 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-3870	23 May 202509:21	–	redhatcve
Vulnrichment	CVE-2024-3870 Contact Form 7 Database Addon – CFDB7 <= 1.2.6.8 - Unauthenticated Sensitive Information Exposure	2 May 202416:52	–	vulnrichment

[
  {
    "vendor": "arshidkv12",
    "product": "Database Addon for Contact Form 7 – CFDB7",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.2.6.8",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/995a6c1d-fb49-4953-9828-f6594ac45fa7
plugins	www.plugins.trac.wordpress.org/browser/contact-form-cfdb7/trunk/contact-form-cfdb-7.php
plugins	www.plugins.trac.wordpress.org/changeset/3077090/

08 Apr 2026 17:10Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.15.3

EPSS0.00738

CWE-200