Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension by WordPress
CVE-2026-62043

7.5HIGH

Key Information:

Vendor

WordPress
Status
Contact Form 7 – Dynamic Text Extension
Vendor
CVE Published:
10 October 2026

What is CVE-2026-62043?

The Contact Form 7 – Dynamic Text Extension plugin for WordPress versions up to 5.0.7 is susceptible to unauthenticated sensitive data exposure. This vulnerability allows attackers to access sensitive information without authentication, potentially compromising user data and website integrity. Administrators are urged to update to the latest version to mitigate the risks associated with this vulnerability, ensuring that sensitive information remains secure and accessible only to authorized users.

Affected Version(s)

Contact Form 7 – Dynamic Text Extension <= 5.0.7

References

https://patchstack.com/database/wordpress/plugin/contact-...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Asim Alshaya | Patchstack Bug Bounty Program
.