PT-2026-8045 · WordPress · Stickeasy Protected Contact Form

Itthidej Aramsri · Published 2026-02-14 · Updated 2026-02-14 · CVE-2025-13973

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions StickEasy Protected Contact Form plugin for WordPress versions up to and including 1.0.2

Description The StickEasy Protected Contact Form plugin for WordPress has a flaw that allows unauthorized access to sensitive information. Specifically, spam detection logs are stored in a publicly accessible location at wp-content/uploads/stickeasy-protected-contact-form/spcf-log.txt. This allows unauthenticated attackers to download the log file and potentially access visitor IP addresses, email addresses, and portions of contact form submissions identified as spam.

Recommendations Update the StickEasy Protected Contact Form plugin to a version beyond 1.0.2.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-13973

Affected Products

Stickeasy Protected Contact Form

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-13973 · Security Note
• https://twitter.com/CVEarity/status/2022556828513538253 · Twitter Post
• https://t.me/CVEtracker/44674 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/86edc116-054f-4962-a57c-0ce7e1b8ff8c?source=cve · Note
• https://twitter.com/CVEnew/status/2022543948758061497 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2022617214973526253 · Twitter Post
• https://plugins.trac.wordpress.org/browser/stickeasy-protected-contact-form/tags/1.0.0/stickeasy-protected-contact-form.php#L157 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3425729%40stickeasy-protected-contact-form&new=3425729%40stickeasy-protected-contact-form · Note
• https://plugins.trac.wordpress.org/browser/stickeasy-protected-contact-form/trunk/stickeasy-protected-contact-form.php#L157 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3426722%40stickeasy-protected-contact-form&new=3426722%40stickeasy-protected-contact-form · Note