PT-2026-8045 · WordPress · Stickeasy Protected Contact Form

Itthidej Aramsri · CVE-2025-13973 · Publicado 2026-02-14 · Atualizado 2026-02-14

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions StickEasy Protected Contact Form plugin for WordPress versions up to and including 1.0.2

Description The StickEasy Protected Contact Form plugin for WordPress has a flaw that allows unauthorized access to sensitive information. Specifically, spam detection logs are stored in a publicly accessible location at wp-content/uploads/stickeasy-protected-contact-form/spcf-log.txt. This allows unauthenticated attackers to download the log file and potentially access visitor IP addresses, email addresses, and portions of contact form submissions identified as spam.

Recommendations Update the StickEasy Protected Contact Form plugin to a version beyond 1.0.2.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2025-13973

Produtos afetados

Stickeasy Protected Contact Form

Referências · 10

• https://twitter.com/CVEarity/status/2022556828513538253 · Publicação no Twitter
• https://t.me/CVEtracker/44674 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/86edc116-054f-4962-a57c-0ce7e1b8ff8c?source=cve · Nota
• https://twitter.com/CVEnew/status/2022543948758061497 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2022617214973526253 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-13973 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/stickeasy-protected-contact-form/tags/1.0.0/stickeasy-protected-contact-form.php#L157 · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3425729%40stickeasy-protected-contact-form&new=3425729%40stickeasy-protected-contact-form · Nota
• https://plugins.trac.wordpress.org/browser/stickeasy-protected-contact-form/trunk/stickeasy-protected-contact-form.php#L157 · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3426722%40stickeasy-protected-contact-form&new=3426722%40stickeasy-protected-contact-form · Nota