WordPress Plugin Vulnerabilities

Contact Form 7 Extension For Mailchimp < 0.9.69 - Authenticated (Contributor+) Information Exposure

Description

The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.54. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive user or configuration data.

Affects Plugins

Plugin icon
contact-form-7-mailchimp-extension
Fixed in 0.9.69

References

CVE
CVE-2025-68989
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8ca1bf69-bc71-4137-a908-58c1915f654a

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Bao - BlueRock
Verified
No
WPVDB ID
81515cc6-c237-4186-b12d-1a6946d912ed

Timeline

Publicly Published
2025-12-21 (about 6 months ago)
Added
2026-01-06 (about 5 months ago)
Last Updated
2026-01-13 (about 5 months ago)

Other

Published
Title
Published
2026-04-28
Title
Fortis For WooCommerce < 1.3.1 - Sensitive API Key Disclosure
Published
2024-07-15
Title
XCloner < 4.7.4 - Unauthenticated Full Path Disclosure
Published
2024-04-05
Title
Contact Form Email < 1.3.45 - Unauthenticated Sensitive Information Exposure
Published
2024-12-19
Title
Seraphinite Accelerator <= 2.22.15 (2.21.13 PRO) - Authenticated (Subscriber+) Information Exposure
Published
2024-07-10
Title
Duplicator < 1.5.10 - Full Path Disclosure