CVE-2026-120407

The Contact Form 7 WordPress plugin (versions before 6.2.5 ) contains a vulnerability where form field default values do not restrict which user properties they can be populated from. This flaw allows users with the Editor role or higher to access sensitive information, such as password hashes an...