This vulnerability in ThemeHunk's Contact Form & Lead Form Elementor Builder plugin allows an attacker with low privileges to access sensitive system information embedded within the plugin. The flaw affects versions up to and including 2.0.1. The vulnerability is classified under CVE-2025-68046 with a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily on confidentiality. No integrity or availability impact is noted. No vendor advisory or patch information is currently available, and the plugin is not a cloud service, so remediation depends on vendor updates.

An attacker with limited privileges can retrieve sensitive system information, potentially aiding further attacks or reconnaissance. The confidentiality of sensitive data is compromised, but there is no direct impact on system integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the plugin and monitor for suspicious activity related to information disclosure. Avoid granting unnecessary privileges to users interacting with the plugin.