CVE-2025-53309 MEDIUM

CVE-2025-53309: WordPress Accept Stripe Payments Using Contact Form 7 plugin <= 3.0 - Sensitive Data Exposure Vulnerability

Vendor Zealousweb
Product Accept Stripe Payments Using Contact Form 7
Weakness CWE-201
Published June 27, 2025
Last update May 13, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Stripe Payments Using Contact Form 7 accept-stripe-payments-using-contact-form-7 allows Retrieve Embedded Sensitive Data.This issue affects Accept Stripe Payments Using Contact Form 7: from n/a through <= 3.0.

Explanation of Vulnerability in Simple Terms

02Summary

The Accept Stripe Payments Using Contact Form 7 plugin for WordPress versions 3.0 and earlier exposes sensitive payment information to unauthenticated attackers. An attacker can read partial payment card data and other confidential details without needing to log in or interact with a site administrator. Update to a version newer than 3.0 immediately.

What an attacker can do

03Attacker Capabilities

Read partial payment card data and sensitive payment information without authentication.

Potential impact on your site

04Site Impact

Payment card data and customer financial information may be exposed to the public internet.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

June 27, 2025 CVE published
May 13, 2026 Record updated