The Accept SagePay Payments Using Contact Form 7 WordPress plugin contains a sensitive information exposure flaw that lets unauthenticated attackers download the publicly accessible phpinfo.php file. The file can reveal configuration details, environment variables, database credentials, and other confidential data needed for further compromise. This vulnerability is identified as CWE‑200 and can lead to significant confidentiality loss with no requirement for elevated privileges.

Vulnerable instances are WordPress sites that have the Accept SagePay Payments Using Contact Form 7 plugin installed at version 2.0 or earlier. The plugin is maintained by ZealOpenSource and is listed in the official WordPress plugin repository. Any site using an affected version is at risk; specific version ranges are not provided beyond the upper bound of 2.0.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild, yet the attack does not require any authentication or complex setup. The vulnerability is not included in the CISA KEV catalog. An attacker can simply request the phpinfo.php URL and retrieve the file, so the primary attack vector is a direct HTTP request to the exposed script.