This vulnerability in the ZealousWeb 'Accept Authorize.NET Payments Using Contact Form 7' plugin allows an attacker to insert sensitive information into data sent by the plugin, which may lead to unauthorized retrieval of embedded sensitive data. The affected versions include all versions up to 2.5. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without authentication or user interaction, with a limited confidentiality impact and no impact on integrity or availability. No patch or vendor advisory has been provided to confirm remediation status.

The vulnerability could allow an attacker to obtain sensitive information embedded in data sent by the plugin, potentially exposing confidential payment or user data. However, the impact is limited to confidentiality, with no direct effect on data integrity or system availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure of the affected plugin or disabling it if possible to reduce risk. Monitor vendor channels for updates regarding patches or official mitigations.