CVE-2024-3870 is a vulnerability in the Contact Form 7 Database Addon – CFDB7 WordPress plugin (up to version 1.2.6.8) that exposes sensitive information to unauthorized actors. The flaw exists in the cfdb7_before_send_mail function, which can be exploited by unauthenticated attackers to retrieve sensitive data, including Personally Identifiable Information from files uploaded by users. The vulnerability is rated medium severity with a CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). There is no vendor advisory or patch link available at this time, and no known active exploitation has been reported.

An unauthenticated attacker can exploit this vulnerability to access sensitive information stored or processed by the vulnerable plugin, specifically data from user-uploaded files. This exposure could lead to privacy violations and potential misuse of Personally Identifiable Information. The vulnerability does not impact integrity or availability, only confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the vulnerable plugin version to prevent exploitation. Monitor official sources for updates or patches from the plugin author or WordPress security teams.