{"id":"CVE-2026-62043","published":"2026-10-10T20:16:40.137","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-201"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/contact-form-7-dynamic-text-extension/vulnerability/wordpress-contact-form-7-dynamic-text-extension-plugin-5-0-7-sensitive-data-exposure-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Contact Form 7 Dynamic Text Extension allows unauthenticated users to access sensitive data through a vulnerable contact form endpoint, potentially exposing personal information like names, emails, and custom field values without requiring authentication or any user interaction.","exploitability":"Exploitation is straightforward with no prerequisites as the vulnerability affects unauthenticated access to sensitive data exposed via the dynamic text extension's API endpoint.","blast_radius":"The impact could be significant across all websites using Contact Form 7 Dynamic Text Extension versions 5.0.7 or earlier, potentially exposing personal information from contact forms including user details and custom form fields.","remediation":"Upgrade to Contact Form 7 Dynamic Text Extension version 5.0.8 or later to remediate this sensitive data exposure vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["data-exfiltration","web","form-processing","unauthenticated-access"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:11:02.284Z"}}