The Quick Contact Form plugin allows an attacker to send email messages from the web server by specifying a forged "from" address via the qcf_validate_form AJAX endpoint. This flaw permits unauthenticated parties to use the server as a relay to deliver messages to arbitrary recipients, potentially enabling phishing, spamming, or malicious routing of sensitive information. The weakness is a classic input validation failure, classified as CWE-20.

WordPress sites running the Quick Contact Form plugin version 8.2.6 or earlier, including all releases up to and including 8.2.6. The vendor is Saadiqbal, who provides the plugin under the product name Quick Contact Form.

The CVSS score for this issue is 5.8, indicating a moderate risk. The EPSS score is below 1%, suggesting a very low probability of exploitation at this time. It is not listed in the CISA KEV catalog. Attackers would need only unauthenticated HTTP access to the site and would exploit the public AJAX endpoint to set the "from" address, resulting in the server relaying the email.