CVE-2025-13717

Name of the Vulnerable Software and Affected Versions Contact Form vCard Generator versions up to and including 2.4

Description The Contact Form vCard Generator plugin for WordPress has a flaw where a missing capability check on the wp gvccf check download request function allows unauthorized access to data. Unauthenticated attackers can exploit this to export sensitive Contact Form 7 submission data using the wp-gvc-cf-download-id parameter. This data includes names, phone numbers, email addresses, and messages.

Recommendations Versions prior to and including 2.4 should be updated.