CVE-2026-120407

The Contact Form 7 WordPress plugin (versions before 6.2.5 ) contains a vulnerability where form field default values do not restrict which user properties they can be populated from. This flaw allows users with the Editor role or higher to access sensitive information, such as password hashes an...

WordPress Contact Form 7 plugin < 6.2.5 - Editor+ Sensitive User Data Disclosure vulnerability

Editor+ Sensitive User Data Disclosure vulnerability discovered by Epihack Bénin in WordPress Plugin Contact Form 7 versions 6.2.5...