The Contact Form by WPForms plugin contains a critical Cross-Site Request Forgery vulnerability that could allow an attacker to perform unauthorized actions on behalf of a victim.

This is a Cross-Site Request Forgery (CWE-352) vulnerability that allows an unauthenticated attacker to trick a logged-in user into performing unintended actions within the WordPress environment. The vulnerability stems from a lack of sufficient CSRF protection in the affected plugin.

The CVSS score of 8.1 reflects a high severity rating due to the potential for significant integrity compromise. Successful exploitation could allow an attacker to modify plugin settings or perform unauthorized form submissions, potentially leading to data manipulation or administrative account actions, depending on the victim's privileges.

Immediate Action: Administrators should verify if a security update is available from the WordPress plugin repository and apply it immediately to address the lack of CSRF tokens. If no patch is currently available, consider temporarily deactivating the plugin until a fix is released.

Proactive Monitoring: Review web server access logs for suspicious POST requests originating from unexpected sources or lacking appropriate referer headers. Monitor administrative audit logs for any unauthorized configuration changes within the plugin settings.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block suspicious requests that lack valid CSRF tokens or originate from unauthorized external domains. Ensure that all administrative sessions are protected by strong authentication policies.

Public Exploit Available: No — exploit_available (false).

Given the high CVSS score and the nature of CSRF vulnerabilities, this issue poses a significant risk to site integrity. Security teams should prioritize monitoring for vendor-provided updates and apply them as soon as they become available. Until a formal patch is deployed, restricting administrative access and utilizing WAF rules to validate requests remain the most effective methods for mitigating the risk of exploitation.