CVE-2023-52208 is a medium severity (5.3 CVSS) sensitive information exposure in the Constant Contact Forms plugin for WordPress, in versions through 2.4.2. It can be triggered without logging in. Patchstack lists 2.4.3 as the patched release, so update to 2.4.3 or later.
What's affected
The NVD record covers Constant Contact Forms from Constant Contact, versions through 2.4.2, and describes exposure of sensitive information to an unauthorized actor. The weakness is CWE-200 (Exposure of Sensitive Information). Patchstack describes the exposure through a log file, according to the title of the Patchstack advisory.
The record does not say what data is exposed, and we will not guess. The vector rates confidentiality impact as low, with no privileges and no user interaction needed.
How to check if you're exposed
On a site you manage, list installed plugins and their versions with wp-cli:
wp plugin list --fields=name,version,update_version,status
wp plugin get constant-contact-forms --field=version
The slug constant-contact-forms comes from the Patchstack advisory address, so confirm it matches the folder under wp-content/plugins on your site. A version of 2.4.2 or lower is in the affected range. The Plugins screen in the dashboard shows the same version number.
Then look for log files the plugin writes inside the web root. If you can fetch a plugin log file in a browser without logging in, so can anyone else. Check your own site only, and do not post what you find.
What to do now
- Back up the site.
- Update Constant Contact Forms to 2.4.3 or later, from the dashboard or with
wp plugin update constant-contact-forms. - Delete old plugin log files that sit in a web-accessible folder, once you have kept a copy offline for review.
- Read the retained logs for tokens, keys, email addresses or other secrets, and rotate anything sensitive.
- Add a rule at your web server or host to deny direct access to files you do not intend to serve.
Why it matters
Logs are written for developers, and developers log more than they should. When a log file sits in a folder the web server serves, the secrecy of its contents depends on nobody guessing the path. CWE-200 (Exposure of Sensitive Information) covers exactly that habit.
The fix removes the exposure going forward. It does not undo what was already readable, so treat anything that was in the log as potentially seen. The KEV flag in the record is false, and none of the sources we read claim exploitation in the wild.
Quick check
Does updating remove the data that was already exposed?
No. The update closes the hole. Data that was readable before the update may have been seen, so review it and rotate secrets.
Do I need to tell anyone?
That depends on what was exposed and on your legal duties. Work out what the plugin held, then involve whoever owns privacy and compliance for the site.
Sources
Last reviewed: 19 October 2026.
