CVE-2026-120407: Contact Form 7 < 6.2.5 - Editor+ Sensitive User Data Disclosure via Form Default Values
The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value can be populated from, allowing users with the Editor role and above to obtain the password hash and sensitive user meta (such as two-factor secrets) of higher-privileged users, including administrators, who view and submit the form.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Contact Form 7to a version that resolves this vulnerability.Fixed in 6.2.5
Event History
Frequently Asked Questions
Which users are exposed to having data disclosed?
Higher-privileged users, including administrators, are exposed when they view and submit a form configured with a malicious default-value source. The disclosed data can include password hashes and sensitive user metadata such as two-factor secrets.
What level of access does an attacker need?
An attacker needs a WordPress account with the Editor role or higher and the ability to configure a Contact Form 7 form field's default value. Exploitation also requires a higher-privileged user to view and submit that form.
Are affected installations limited to nondefault configurations?
Exploitation depends on a form being configured to populate a field default value from user properties. The provided information does not state whether any default Contact Form 7 forms include such a configuration.
How can I identify potentially malicious forms before updating?
Review Contact Form 7 forms that Editors or higher-privileged users can modify, focusing on field default-value settings that reference user properties or metadata. Forms designed to collect submissions from administrators or other privileged users warrant particular attention.