CVE-2026-25339
Sensitive Data Exposure in WPForms Contact Form Plugin
Publication date: 2026-03-25
Last updated on: 2026-04-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| syed_balkhi | contact_form_by_wpforms | to 1.9.8.7 (inc) |
| wpforms | wpforms-lite | to 1.9.8.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-25339 is a Sensitive Data Exposure vulnerability in the WordPress Contact Form by WPForms plugin versions up to and including 1.9.8.7.
This vulnerability allows unauthorized actors to retrieve embedded sensitive information that should normally be restricted.
Exploitation requires user interaction by a privileged user, such as clicking a malicious link, visiting a crafted page, or submitting a form.
The issue is classified with a moderate severity level (CVSS score 6.5) and falls under the OWASP Top 10 category A3: Sensitive Data Exposure.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to sensitive information embedded in the data sent through the Contact Form by WPForms plugin.
Such exposure could enable further exploitation of the system by attackers.
However, exploitation requires user interaction by a privileged user, which limits the impact.
Users of affected versions are strongly advised to update to version 1.9.9.2 or later to mitigate this risk.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability CVE-2026-25339 in the Contact Form by WPForms plugin, you should update the plugin to version 1.9.9.2 or later, where the issue is patched.
Additionally, consider using automated update and rapid vulnerability mitigation services such as those offered by Patchstack to ensure timely protection.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability CVE-2026-25339 in the Contact Form by WPForms Plugin allows unauthorized access to sensitive information, which constitutes a Sensitive Data Exposure issue.
Exposure of sensitive data can lead to non-compliance with common standards and regulations such as GDPR and HIPAA, which require protection of personal and sensitive information.
Although the vulnerability requires user interaction and is considered low priority due to limited impact, any unauthorized data exposure can potentially violate these regulations' requirements for data confidentiality and security.
Users are strongly advised to update to the patched version 1.9.9.2 or later to mitigate the risk and maintain compliance.