The plugin writes spam detection logs to a predictable location under wp‑content/uploads, making the file publicly readable. An unauthenticated attacker can retrieve the spcf‑log.txt file and obtain visitor IP addresses, email addresses, and comment snippets that were classified as spam, thereby violating confidentiality. This falls under CWE‑200, Sensitive Data Exposure.

The vulnerability affects the StickEasy Protected Contact Form plugin for WordPress developed by Kasuga16. All released versions up to and including 1.0.2, which store logs in the public uploads folder, are impacted.

The CVSS score of 5.3 classifies the issue as moderate severity, while the EPSS score of <1% indicates a very low probability of exploitation at the time of analysis. The inconsistency between the EPSS metric and the CVSS score is a reminder that the vulnerability is straightforward to exploit: an attacker merely needs to request the public log file through the web server without authentication. The vulnerability is not listed in the CISA KEV catalog, so it is not a known exploited vulnerability as of now. Nonetheless, because the exposure is purely informational, organizations should consider patching promptly, especially if sensitive data is handled via the contact form.