CVE-2026-73384: Pay with Contact Form 7 Data Exposure

CVE-2026-73384 Overview

CVE-2026-73384 is an unauthenticated sensitive data exposure vulnerability in the Pay with Contact Form 7 WordPress plugin, affecting versions 1.0.4 and earlier. The flaw allows remote attackers to access sensitive information without authentication or user interaction. The issue is classified under [CWE-201] (Insertion of Sensitive Information Into Sent Data) and stems from the plugin exposing data intended to remain private.

Because the plugin handles payment-related form submissions, exposed data may include configuration values or transaction details relevant to attackers targeting WordPress e-commerce sites.

Critical Impact

Remote attackers can retrieve sensitive information from vulnerable WordPress sites without credentials, enabling reconnaissance and follow-on attacks against payment workflows.

Affected Products

• Pay with Contact Form 7 WordPress plugin versions 1.0.4 and earlier
• WordPress sites integrating Contact Form 7 with payment functionality via this plugin
• Any deployment using the vulnerable plugin in production environments

Discovery Timeline

• 2026-08-19 - CVE-2026-73384 published to NVD
• 2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73384

Vulnerability Analysis

The vulnerability exists in the Pay with Contact Form 7 plugin, which bridges the widely used Contact Form 7 plugin with payment processing on WordPress sites. In versions up to and including 1.0.4, the plugin discloses sensitive data to unauthenticated requestors. An attacker sending crafted HTTP requests to a vulnerable endpoint receives information that should require authorization to view.

The [CWE-201] classification indicates that the plugin inserts sensitive information into responses or transmitted data without adequate protection. This category covers scenarios where server responses, debug output, or API endpoints leak credentials, tokens, personally identifiable information, or configuration data to parties who should not have access.

Because the plugin is tied to payment workflows, disclosed information can include contextual data useful for targeting transactions, enumerating form submissions, or mapping the site's integration with external payment providers. Refer to the Patchstack advisory for details.

Root Cause

The plugin fails to enforce authorization checks or apply data-scoping controls before returning sensitive information. Requests that should be restricted to authenticated administrators or capability-scoped users are instead served to anonymous callers, resulting in unauthenticated information disclosure.

Attack Vector

An attacker exploits this issue over the network by issuing standard HTTP requests to the vulnerable WordPress site. No credentials, user interaction, or elevated privileges are required. The attacker parses the response to extract sensitive fields exposed by the plugin.

Detection Methods for CVE-2026-73384

Indicators of Compromise

• Unauthenticated HTTP GET or POST requests targeting Pay with Contact Form 7 plugin endpoints under /wp-content/plugins/pay-with-contact-form-7/ or related admin-ajax.php and REST routes.
• Anomalous outbound response sizes from plugin endpoints returned to non-logged-in sessions.
• Repeated requests from a single IP enumerating plugin-related URLs on WordPress hosts.

Detection Strategies

• Inventory WordPress installations and identify sites running Pay with Contact Form 7 at version 1.0.4 or earlier.
• Review web server access logs for unauthenticated requests to plugin-specific endpoints returning non-empty response bodies.
• Correlate WordPress audit logs with reverse proxy or WAF telemetry to identify scraping patterns against form submission or configuration endpoints.

Monitoring Recommendations

• Alert on unusual query volume against /wp-json/ and admin-ajax.php from unauthenticated sources.
• Track HTTP 200 responses to plugin endpoints from IP addresses without an active WordPress session cookie.
• Deploy WAF rules that log and rate-limit access to plugin routes associated with Pay with Contact Form 7.

How to Mitigate CVE-2026-73384

Immediate Actions Required

• Update the Pay with Contact Form 7 plugin to a version later than 1.0.4 as soon as a fixed release is published by the vendor.
• If no patched version is yet available, deactivate and remove the plugin from affected WordPress installations.
• Rotate any credentials, API keys, or tokens that may have been exposed through the vulnerable endpoints.

Patch Information

Consult the Patchstack advisory for the current patch status and remediation guidance. Administrators should apply the vendor-supplied update through the standard WordPress plugin update workflow once released.

Workarounds

• Block external access to the plugin's endpoints at the web application firewall or reverse proxy layer until a patched version is installed.
• Restrict access to /wp-admin/admin-ajax.php and REST API routes tied to the plugin using IP allowlists where feasible.
• Audit historical access logs to assess prior exposure and identify any data that may already have been disclosed.

# Example: block plugin path at the web server layer (nginx)
location ~* /wp-content/plugins/pay-with-contact-form-7/ {
    deny all;
    return 403;
}