Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Contact Form 7 versions 3.0.2 and below expose user location

CVE-2026-73386 · published 2 months ago
Summary

If you're using Contact Form 7, an attacker can see the location of users who fill out your form without needing to log in. This is a concern because it could allow an attacker to track users. To protect your users, update Contact Form 7 to the latest version.

Original advisory text
Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions.
Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-201Insertion of Sensitive Information Into Sent Data
Timeline
Published19 Aug 2026
Updated4 Nov 2026
First seen19 Aug 2026
Sources
CVE-2026-73386 · NVD
Track software like this
Free during beta