CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Insertion of Sensitive Information Into Sent Data vulnerability in Renzo Johnson contact-form-7-mailchimp-extension contact-form-7-mailchimp-extension allows Retrieve Embedded Sensitive Data.This issue affects contact-form-7-mailchimp-extension: from n/a through <= 0.9.68.
Explanation of Vulnerability in Simple Terms
The Contact Form 7 Mailchimp Extension versions 0.9.68 and earlier expose sensitive information to authenticated users with low privileges. An attacker with a low-privilege account can read data they should not have access to. Update to version 0.9.69 or later to patch this vulnerability.
What an attacker can do
Read sensitive information accessible only to higher-privilege users.
Potential impact on your site
User data or configuration details may be exposed to low-privilege site members or subscribers.
Conditions required to exploit
Attacker must have a low-privilege account on the site.
Key dates
External resources
Related vulnerabilities
