This vulnerability (CVE-2025-53309) affects the ZealousWeb 'Accept Stripe Payments Using Contact Form 7' plugin versions up to 3.0. It involves the insertion of sensitive information into data sent by the plugin, which could allow retrieval of embedded sensitive data. The CVSS 3.1 base score is 5.3 (medium), with an attack vector of network, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality loss. No known exploits in the wild or vendor patches are currently documented.

The vulnerability may lead to unauthorized disclosure of sensitive information embedded in data sent by the plugin. There is no reported impact on data integrity or availability. Exploitation could result in partial confidentiality loss, potentially exposing sensitive user or payment information handled by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure by restricting access to the affected plugin or disabling it if feasible. Monitor official ZealousWeb communications for updates on patches or mitigations.