CVE-2026-62043: CWE-201 Insertion of Sensitive Information Into Sent Data in sevenspark Contact Form 7 – Dynamic Text Extension

This vulnerability (CVE-2026-62043) in the Contact Form 7 – Dynamic Text Extension plugin (sevenspark) is classified as CWE-201: Insertion of Sensitive Information Into Sent Data. It affects all versions up to and including 5.0.7. The flaw allows unauthenticated attackers to access sensitive data that is inserted into sent form data, potentially exposing confidential information. The CVSS 3.1 base score is 7.5, indicating high severity, with attack vector network, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

An unauthenticated attacker can gain access to sensitive information transmitted by the vulnerable plugin, potentially leading to data leakage. The confidentiality of sensitive data is compromised, but there is no impact on data integrity or availability. This could expose private user or system information handled by the form extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, consider disabling or restricting access to the vulnerable plugin to prevent exposure.