This vulnerability in the Contact Form by WPForms plugin (up to version 1.9.8.7) allows an attacker to cause sensitive information to be inserted into data sent by the plugin, enabling retrieval of embedded sensitive data. The issue is classified as an insertion of sensitive information into sent data, which could lead to unauthorized disclosure of sensitive content. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction, with a high impact on confidentiality and no impact on integrity or availability.

Successful exploitation could lead to unauthorized disclosure of sensitive information embedded in the data sent by the vulnerable plugin. This compromises confidentiality but does not affect data integrity or availability. There are no known exploits in the wild currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor vendor communications for updates and consider restricting use or applying temporary mitigations if available.