Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Accept SagePay Payments Using Contact Form 7 by zealopensource

    CVE-2025-2883 (GCVE-0-2025-2883)

    Vulnerability from nvd – Published: 2025-04-08 09:21 – Updated: 2026-04-08 17:31
    VLAI
    Title
    Accept SagePay Payments Using Contact Form 7 <= 2.0 - Unauthenticated Information Exposure
    Summary
    The Accept SagePay Payments Using Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    References
    Impacted products
    Credits
    Avraham Shemesh
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-2883",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:03:58.229806Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:04:15.032Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Accept SagePay Payments Using Contact Form 7",
          "vendor": "zealopensource",
          "versions": [
            {
              "lessThanOrEqual": "2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Avraham Shemesh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Accept SagePay Payments Using Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:31:36.570Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ed6cbd55-0e3a-4343-9e1b-b413a132bcdd?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/accept-sagepay-payments-using-contact-form-7/trunk/inc/front/template/cfspzw-info.php#L6"
        },
        {
          "url": "https://wordpress.org/plugins/accept-sagepay-payments-using-contact-form-7/#developers"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3266837/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-07T21:19:21.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Accept SagePay Payments Using Contact Form 7 \u003c= 2.0 - Unauthenticated Information Exposure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-2883",
    "datePublished": "2025-04-08T09:21:20.256Z",
    "dateReserved": "2025-03-27T20:52:03.183Z",
    "dateUpdated": "2026-04-08T17:31:36.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-2883 (GCVE-0-2025-2883)

    Vulnerability from cvelistv5 – Published: 2025-04-08 09:21 – Updated: 2026-04-08 17:31
    VLAI
    Title
    Accept SagePay Payments Using Contact Form 7 <= 2.0 - Unauthenticated Information Exposure
    Summary
    The Accept SagePay Payments Using Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    References
    Impacted products
    Credits
    Avraham Shemesh
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-2883",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:03:58.229806Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:04:15.032Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Accept SagePay Payments Using Contact Form 7",
          "vendor": "zealopensource",
          "versions": [
            {
              "lessThanOrEqual": "2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Avraham Shemesh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Accept SagePay Payments Using Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:31:36.570Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ed6cbd55-0e3a-4343-9e1b-b413a132bcdd?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/accept-sagepay-payments-using-contact-form-7/trunk/inc/front/template/cfspzw-info.php#L6"
        },
        {
          "url": "https://wordpress.org/plugins/accept-sagepay-payments-using-contact-form-7/#developers"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3266837/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-07T21:19:21.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Accept SagePay Payments Using Contact Form 7 \u003c= 2.0 - Unauthenticated Information Exposure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-2883",
    "datePublished": "2025-04-08T09:21:20.256Z",
    "dateReserved": "2025-03-27T20:52:03.183Z",
    "dateUpdated": "2026-04-08T17:31:36.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}