CVE-2026-24557: 
WordPress vulnerability analysis and mitigation

CVE-2026-24557 is a Sensitive Data Exposure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) affecting the WEN Solutions Contact Form 7 GetResponse Extension WordPress plugin. All versions up to and including 1.0.8 are affected. The vulnerability was reported by researcher Nabil Irawan on December 23, 2025, and published by Patchstack on January 22–23, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium), assessed by CISA-ADP (Patchstack).

The vulnerability is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes sensitive data — likely API keys or credentials used to communicate with the GetResponse email marketing service — within data transmitted or exposed in a way accessible to unauthorized parties. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially accessible to any remote attacker. No detailed technical write-up or proof-of-concept code has been publicly released beyond the Patchstack advisory (Patchstack).

Successful exploitation allows an unauthenticated remote attacker to retrieve embedded sensitive data — potentially including API keys or integration credentials for the GetResponse email marketing platform. This could enable an attacker to access or manipulate the associated GetResponse account, harvest subscriber data, or leverage the exposed credentials for further attacks against connected systems. The confidentiality impact is rated Low, with no integrity or availability impact (Patchstack).

No official patch is currently available for this vulnerability, and no in-the-wild exploitation has been publicly reported. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this type can be used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Contact Form 7 GetResponse Extension plugin (version ≤ 1.0.8) via passive scanning tools (e.g., WPScan, Shodan) or by checking publicly accessible plugin metadata at /wp-content/plugins/contact-form-7-getresponse-extension/.
2. Access exposed data: Send unauthenticated HTTP requests to the target WordPress site, targeting endpoints or responses where the plugin embeds sensitive information (e.g., page source, API responses, or JavaScript files that may contain hardcoded credentials).
3. Extract sensitive information: Parse the response to retrieve embedded sensitive data such as GetResponse API keys or other integration credentials.
4. Leverage extracted credentials: Use the obtained API key to authenticate directly with the GetResponse API, enabling access to subscriber lists, campaign data, or account settings for further abuse (Patchstack).

• Network: Unusual unauthenticated HTTP GET requests to WordPress plugin directories or pages associated with the Contact Form 7 GetResponse Extension; unexpected outbound API calls to GetResponse endpoints from the web server.
• Logs: Web server access logs showing repeated requests to plugin-related paths (e.g., /wp-content/plugins/contact-form-7-getresponse-extension/) from unfamiliar IP addresses.
• Application: Unexpected activity in the associated GetResponse account, such as unauthorized list exports, new API key generation, or unusual campaign modifications.

As of the time of publication, no official patched version of the Contact Form 7 GetResponse Extension plugin is available. Site administrators should consider deactivating and removing the plugin until a fix is released. As a workaround, rotate any GetResponse API keys configured within the plugin and restrict access to sensitive WordPress directories via server-level controls (e.g., .htaccess rules). Monitor the WEN Solutions plugin page and the WordPress Plugin Repository for an updated release (Patchstack).