CVE-2025-12825 MEDIUM

CVE-2025-12825: User Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information Exposure

Vendor Zealopensource
Product User Registration Using Contact Form 7
Weakness CWE-862 · Missing authorization
Published January 17, 2026
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_cf7_form_data' function in all versions up to, and including, 2.5. This makes it possible for unauthenticated attackers to retrieve form settings which includes Facebook app secrets.

Explanation of Vulnerability in Simple Terms

02Summary

User Registration Using Contact Form 7 versions 2.5 and earlier lack proper authorization checks, allowing unauthenticated attackers to read sensitive user data. The vulnerability requires no user interaction and is exploitable over the network. Site administrators should update to a version newer than 2.5 to prevent unauthorized information disclosure.

What an attacker can do

03Attacker Capabilities

Read sensitive user information without logging in.

Potential impact on your site

04Site Impact

Visitor and user data may be exposed to unauthenticated attackers.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

January 17, 2026 CVE published
April 8, 2026 Record updated