The Accept PayPal Payments using Contact Form 7 WordPress plugin, in versions prior to 4.0.7, lacks an authorization check before providing a CSV export of stored form submissions. This flaw permits any unauthenticated user to request the export and receive every submitted payment form’s personal information—name, email address, telephone number, postal address, message—and related payment metadata. The resulting confidentiality breach exposes sensitive personal data and could be leveraged for identity theft or fraud.

Any WordPress site that installed the Accept PayPal Payments using Contact Form 7 plugin before version 4.0.7 and has the CSV export feature enabled is vulnerable. The CNA did not supply version range, so all installations of the plugin older than 4.0.7 should be considered affected.

An attacker can trivially trigger the CSV export without authentication, immediately obtaining the protected data. The CVSS score of 5.3 reflects a moderate severity due to compromised confidentiality. The EPSS score of less than 1 % indicates that, at present, the probability of exploitation is low, and the vulnerability is not included in the CISA KEV catalog. Nonetheless, the lack of authorization and potential for PII exposure make it a high‑risk security concern that should be remediated promptly.