A Cross‑Site Request Forgery (CWE‑352) exists in the CRM‑Perks WP Zendesk for Contact Form 7 plugin and its variants for WPForms, Elementor, Formidable and Ninja Forms. The flaw enables an attacker to send forged requests that change plugin settings without the victim’s consent. This can lead to arbitrary configuration changes, potentially redirecting form submissions or exposing sensitive data. The impact is confined to the administrator’s account on the affected WordPress site, but it allows the attacker to alter the behavior of contact forms.

WordPress sites running any of the following products—WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable or Ninja Forms—between their initial release up to version 1.1.3 are affected. The flaw is present in all editions of these plugins that had not yet been updated beyond 1.1.3.

The CVSS score of 4.3 indicates a medium severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would likely need to compromise an authenticated admin session or persuade a logged‑in user to click a malicious link. However, because the flaw relies on CSRF, it is exploitable through a standard web request that targets the plugin’s settings endpoint.