WEN Solutions Contact Form 7 GetResponse Extension suffers from a Sensitive Data Exposure flaw that allows the plugin to insert sensitive information into transmitted data, thereby leaking embedded sensitive data to unintended recipients. This vulnerability arises from improper sanitization of outgoing requests, enabling an attacker to obtain confidential information that the plugin handles during form submissions.

Any WordPress installation that uses the WEN Solutions Contact Form 7 GetResponse Extension plugin version 1.0.8 or earlier is affected. The vulnerability applies to all supported WordPress environments where the plugin is active and configured to send form data to GetResponse.

The flaw carries a CVSS score of 5.3, indicating moderate severity. The estimate of exploitation likelihood (EPSS < 1%) is low, and it is not listed in CISA's KEV catalog, suggesting limited public exploitation. Nonetheless, if an attacker can manipulate form submissions or compromise the WordPress site, they may cause the plugin to transmit sensitive data to external endpoints, potentially exposing private user information. The attack vector is inferred to be through the plugin’s outbound HTTP requests triggered by legitimate form usage.