The Tripetto WordPress plugin suffers from a Cross‑Site Request Forgery flaw caused by missing nonce validation in all releases up to 8.0.9. A victim attacker who can persuade a site administrator to click a crafted link can initiate a request that deletes any form submission stored by the plugin. This results in loss of data integrity and availability for any surveys, quizzes, or contact forms managed through Tripetto.

All WordPress installations that use the Tripetto plugin version 8.0.9 or earlier are affected. The vulnerability is present in the core Tripetto plugin delivered as a WordPress form builder, surveys and quizzes extension.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is Cross‑Site Request Forgery; it requires that an unauthenticated attacker convince a legitimate site administrator to perform a specific action such as clicking a link. If successful, the attacker can delete arbitrary form results, potentially impacting data availability but not code execution or system compromise.