This vulnerability in the elfsight Contact Form widget (up to version 2.3.1) allows an attacker to remotely retrieve sensitive system information without authentication or user interaction. The issue results in exposure of embedded sensitive data to an unauthorized control sphere, potentially leading to information disclosure. The CVSS 3.1 base score is 7.5, reflecting high severity due to network attack vector, low attack complexity, no privileges required, and high confidentiality impact. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation leads to unauthorized disclosure of sensitive system information, which could aid attackers in further attacks or reconnaissance. There is no impact on system integrity or availability. The vulnerability affects confidentiality only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, restrict access to the vulnerable widget where possible and monitor for unusual access patterns. Avoid exposing the widget to untrusted networks if feasible.