CVE-2026-120407 · Package
NO FIX YET · SEE WHAT TO DO
Before version 6.2.5, the Contact Form 7 plugin let a form field's default value pull any user property, including password hashes and two-factor secrets. A user with the Editor role can use this to read those values for administrators who view the form.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
WordPress sites running Contact Form 7 before 6.2.5 where users with the Editor role or above can edit forms and administrators view them. Sites with no Editor-level users or without the plugin are not exposed. The sources do not describe the exact form configuration needed.
Not affected if no-editor-users, plugin-updated
Who cares contact-form-7, wordpress
6.2.5 is affected.6.2.5 or later (per the source's 'before 6.2.5' statement)The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value can be populated from, allowing users with the Editor role and above to obtain the password hash and sensitive user meta (such as two-factor secrets) of higher-privileged users, including administrators, who view and submit the form.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.