What the vulnerability does
01Description
The StickEasy Protected Contact Form plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.0.2. The plugin stores spam detection logs at a predictable publicly accessible location (wp-content/uploads/stickeasy-protected-contact-form/spcf-log.txt). This makes it possible for unauthenticated attackers to download the log file and access sensitive information including visitor IP addresses, email addresses, and comment snippets from contact form submissions that were flagged as spam.
Explanation of Vulnerability in Simple Terms
02Summary
StickEasy Protected Contact Form versions 1.0.1 and earlier expose sensitive information that can be accessed over the network without authentication. An attacker can retrieve this data directly without needing to interact with a victim or possess special privileges. The exposure is limited to information disclosure; the attacker cannot modify data or disrupt service.
What an attacker can do
03Attacker Capabilities
Read sensitive information from the contact form without authentication.
Potential impact on your site
04Site Impact
Visitor or form submission data may be exposed to unauthenticated attackers.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
February 14, 2026
CVE published
April 8, 2026
Record updated
