CVE-2025-68989: 
WordPress vulnerability analysis and mitigation

CVE-2025-68989 is a Sensitive Data Exposure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) in the Contact Form 7 Extension For Mailchimp WordPress plugin, developed by Renzo Johnson. The flaw allows authenticated users with at least Contributor-level privileges to retrieve embedded sensitive data that should not be accessible to regular users. All plugin versions up to and including 0.9.68 are affected; version 0.9.69 contains the fix. The vulnerability was reported on November 21, 2025, published December 21–30, 2025, and carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes sensitive data — likely API keys or configuration credentials related to the Mailchimp integration — in data transmitted or exposed to lower-privileged users. Exploitation requires network access and a low-privilege authenticated account (Contributor or Developer role), with no user interaction needed and low attack complexity. No public proof-of-concept exploit code has been identified at this time (Patchstack).

Successful exploitation allows an authenticated attacker to view sensitive information — such as Mailchimp API keys or integration credentials — that is normally restricted to administrators. Exposure of such credentials could enable an attacker to access or manipulate the site's Mailchimp account, harvest subscriber data, or leverage the credentials for further attacks against connected services. There is no direct impact on integrity or availability of the WordPress site itself (Patchstack).

No active in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite the potential for use in mass-exploit campaigns targeting WordPress plugins (Patchstack).

Update the Contact Form 7 Extension For Mailchimp plugin to version 0.9.69 or later, which resolves the vulnerability. Patchstack users can enable auto-update for vulnerable plugins to receive protection automatically. If an immediate update is not possible, restrict Contributor-level access on the WordPress site and rotate any Mailchimp API keys configured within the plugin as a precautionary measure (Patchstack).

The vulnerability was discovered and reported by security researcher Bao from BlueRock and disclosed through Patchstack's vulnerability disclosure program. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).