The vulnerability occurs when the WordPress Contact Form by WPForms plugin incorrectly inserts sensitive information into data that is sent through the form. This flaw allows an attacker to retrieve embedded sensitive data, exposing confidential information such as personal or financial details. It is a classic information‑exposure weakness as identified by CWE‑201, resulting in loss of data confidentiality and potential breach of privacy.

The affected product is Contact Form by WPForms provided by Syed Balkhi. All versions from the first release up through 1.9.8.7 are impacted. The plugin is commonly deployed on WordPress sites and is used to accept user submissions through contact forms.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation is unlikely but still possible. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be through the web form interface; an attacker could craft or submit requests that trigger the plugin to expose sensitive data. Once successful, the attacker can read data that should remain confidential, increasing the risk for affected sites.