CVE-2026-73386: CWE-201 Insertion of Sensitive Information Into Sent Data in ZealousWeb Track Geolocation Of Users Using Contact Form 7

This vulnerability (CVE-2026-73386) involves unauthenticated sensitive data exposure in the ZealousWeb Track Geolocation Of Users Using Contact Form 7 plugin, specifically in versions up to 3.0.2. The issue is categorized as CWE-201, which means sensitive information can be inserted into data sent by the application, potentially exposing it to unauthorized parties. The CVSS v3.1 score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. No patch or vendor advisory is provided, and no known exploits are reported in the wild.

An unauthenticated attacker can gain access to sensitive information that is inserted into data sent by the plugin, potentially leading to data leakage. The confidentiality impact is high, but integrity and availability are not affected. This could compromise user privacy and sensitive geolocation data collected by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or limiting use of the affected plugin version to reduce exposure.