The HelpDesk contact form plugin for WordPress is vulnerable to Cross‑Site Request Forgery due to missing or incorrect nonce validation on the handle_query_args() function. This allows any unauthenticated attacker to forge a request and update the plugin’s license ID and contact form ID settings when a site administrator performs an action such as clicking a link. The result is that an attacker can alter how the contact form behaves or redirect submissions, potentially compromising data integrity or bypassing licensing checks.

All installations of the HelpDesk Contact Form plugin for WordPress with a version of 1.1.5 or older, as distributed by the vendor helpdeskcom. The vulnerability applies to any WordPress site that has the plugin enabled, regardless of the specific administrator account, provided that an administrator remains logged in when the forged request is made.

The CVSS score of 4.3 indicates moderate severity and the EPSS score of less than 1% suggests that currently exploitation is unlikely, though not impossible, especially if an attacker can successfully social‑engineer an administrator into visiting a crafted URL. The vulnerability is not listed in the CISA KEV catalog, indicating that no widely documented active exploitation has been reported. An attacker would need to impersonate an administrator’s HTTP session or rely on the administrator clicking the malicious link; therefore, the attack vector is primarily phishing or link injection. Once the forged request is sent, the plugin blindly accepts the new settings because nonce validation is absent, enabling the attacker to modify configuration without further authentication.