CVE-2026-73384 in Pay With Contact Form 7 Plugin
Summary
by MITRE • 08/19/2026
Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified as an unauthenticated sensitive data exposure within the Pay with Contact form plugin for WordPress, specifically affecting versions up to and including 1.0.4, represents a critical security flaw that compromises the confidentiality of user information stored on targeted websites. This issue stems from insufficient access controls implemented in the plugin's administrative interface or API endpoints, allowing any individual without valid authentication credentials to query and retrieve sensitive data directly from the server. The root cause lies in the failure to enforce proper authorization checks before processing requests intended for retrieving payment records, customer details, or transaction logs associated with Contact Form 7 submissions that utilize this specific integration module.
From a technical perspective, the flaw typically involves an endpoint designed to fetch form submission data which does not verify whether the requesting user possesses administrative privileges or any other valid session token required by WordPress core standards. By exploiting this lack of validation, an attacker can construct malicious HTTP requests using standard tools such as curl or Burp Suite to access internal database records that are meant to be restricted. The vulnerability aligns with CWE-200, which categorizes information exposure through the leakage of sensitive data via improper access controls, and is also associated with CWE-862 regarding missing authorization checks in critical functions.
The operational impact of this vulnerability is severe for organizations relying on WordPress sites that process payments or collect personal identifiable information through Contact Form 7 forms integrated with third-party payment gateways. Attackers can harvest customer names, email addresses, phone numbers, and potentially financial transaction details without triggering any security alerts or requiring login credentials. This exposure not only violates privacy regulations such as GDPR or CCPA but also facilitates further attacks including social engineering campaigns, phishing initiatives, and identity theft against the affected user base. The ease of exploitation means that automated scanners can rapidly identify vulnerable instances across the internet, leading to widespread data breaches if left unpatched.
Mitigation strategies must prioritize immediate remediation by upgrading the Pay with Contact form plugin to version 1.0.5 or later where these access control mechanisms have been corrected and validated against standard WordPress security practices. Administrators should also audit their site for any lingering instances of older versions that may not be visible in standard dashboard updates if installed manually. Implementing a Web Application Firewall can provide temporary protection by blocking requests to known vulnerable endpoints, while regular security audits and penetration testing are recommended to ensure no similar authorization flaws exist elsewhere in the application stack. Monitoring server logs for unusual access patterns to form submission APIs can also aid in early detection of exploitation attempts before significant data loss occurs.