CVE-2025-13973 StickEasy Protected Contact Form <= 1.0.1 - Unauthenticated Information Disclosure
Unauthenticated attackers can download spam detection logs to access sensitive visitor IP addresses, emails, and comment snippets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13973?
CVE-2025-13973 is a medium-severity vulnerability in kasuga16 StickEasy Protected Contact Form, published on 14 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The StickEasy Protected Contact Form plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.0.2. The plugin stores spam detection logs at a predictable publicly accessible location (wp-content/uploads/stickeasy-protected-contact-form/spcf-log.txt). This makes it possible for unauthenticated attackers to download the log file and access sensitive information including visitor IP addresses, email addresses, and comment snippets from contact form submissions that were flagged as spam.
Weakness: CWE-200
Which versions are affected by CVE-2025-13973?
How do I fix CVE-2025-13973?
No fix has been published for CVE-2025-13973 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-13973 being exploited?
There is no known exploitation of CVE-2025-13973 in the wild and no public exploit code.
Sources
Also known as GHSA-9xq4-wg7p-wrhx.