CVE-2026-120407
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 13, 2026
Vendor
unknown
Description
The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value can be populated from, allowing users with the Editor role and above to obtain the password hash and sensitive user meta (such as two-factor secrets) of higher-privileged users, including administrators, who view and submit the form.