CVE-2025-12825

The User Registration Using Contact Form 7 plugin has an error in its functionality. Specifically, in the 'get_cf7_form_data' function, a crucial permission check is bypassed across all versions of the plugin up through version 2.5. As a result, attackers without authentication can obtain access to configuration data containing sensitive information such as Facebook app secret keys.

Based on public CVE data (MITRE/NVD).