CVE-2025-2883

MEDIUM

Contact Form 7 <2.0 - Info Disclosure

Title source: llm
STIX 2.1

Description

The Accept SagePay Payments Using Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.

References (4)

Core 4

Scores

CVSS v3 5.3
EPSS 0.0034
EPSS Percentile 25.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (1)
zealopensource/Accept SagePay Payments Using Contact Form 7 < 2.0
Published Apr 08, 2025
Tracked Since Feb 18, 2026