Threats tagged 'ghsa-q75w-p7rr-vmcf'

A vulnerability in the Contact Form 7 WordPress plugin before version 6.2.5 allows users with Editor role or higher to access sensitive user information. Specifically, these users can obtain password hashes and sensitive user metadata, including two-factor authentication secrets, of higher-privileged users such as administrators by exploiting the form field's default value population mechanism.