CVE-2025-13973 identifies a sensitive information disclosure vulnerability in the kasuga16 StickEasy Protected Contact Form WordPress plugin. The plugin stores spam detection logs in a publicly accessible and predictable file path (wp-content/uploads/stickeasy-protected-contact-form/spcf-log.txt). Because these logs include visitor IPs, email addresses, and spam comment snippets, unauthenticated attackers can retrieve this data without any privileges. The vulnerability affects all versions up to and including 1.0.2. No patch or official fix is currently documented.

An attacker can access sensitive user information such as IP addresses, email addresses, and content from contact form submissions flagged as spam. This exposure can lead to privacy violations and potential targeted attacks against users whose data is leaked. However, the vulnerability does not impact integrity or availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting access to the directory storing the spam logs via web server configuration (e.g., .htaccess rules) or remove the plugin if sensitive data exposure is unacceptable. Monitoring for updates from the vendor kasuga16 is recommended.