The Renzo Johnson contact‑form‑7‑mailchimp‑extension plugin contains a flaw that allows attackers to add sensitive information to outgoing data. When the vulnerability is triggered, the plugin can expose embedded sensitive data that should not be publicly transmitted. This constitutes an information disclosure weakness (CWE‑201) that could compromise confidentiality of data submitted through WordPress contact forms.

WordPress sites that have the Renzo Johnson Contact Form 7 Mailchimp Extension plugin installed, up to and including version 0.9.68. The impact applies to all installations of the plugin listed as affected by the vulnerability, regardless of the WordPress version or theme in use.

The CVSS score of 4.3 indicates a low severity rating, and the EPSS score of less than 1% shows a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via the form interface: an attacker may submit crafted input or simply exploit the plugin’s default submission handling to trigger sensitive data transmission. No additional prerequisites such as elevated privileges are mentioned, so the attack could potentially be performed by anyone with access to the form.