CVE-2024-12255 MEDIUM

CVE-2024-12255: Accept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure

Vendor Zealopensource
Product Accept Stripe Payments Using Contact Form 7
Weakness CWE-200 · Info exposure
Published December 12, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via the cf7sa-info.php file that returns phpinfo() data. This makes it possible for unauthenticated attackers to extract configuration information that can be leveraged in another attack.

Key dates

02Disclosure timeline

December 12, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-11994 APM Server Insertion of Sensitive Information into Log File CVE-2020-12496 ENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 2.x exposures sensitive information to an unauthorized actor CVE-2024-1200 Jspxcms information disclosure CVE-2025-7565 LB-LINK BL-AC3600 Web Management Interface lighttpd.cgi geteasycfg information disclosure CVE-2024-50338 Carriage-return character in remote URL allows malicious repository to leak credentials in Git Credential Manager