The vulnerability is a Cross‑Site Request Forgery (CWE‑352) that allows remote attackers to trick authenticated WordPress users into submitting unintended requests through the Contact Forms by Cimatti plugin. The flaw exists in plugin versions up to 1.9.8 and can enable malicious actions performed with the victim’s privileges, potentially exposing sensitive data or manipulating form submissions.

The affected product is the WordPress plugin Contact Forms by Cimatti found in any WordPress installation that has a plugin version of 1.9.8 or earlier. The vendor is cimatti, and the product is Contact Forms by Cimatti.

The CVSS score is 4.3, indicating a medium impact. The EPSS score is less than 1 %, showing a low likelihood that the vulnerability will be exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need to target authenticated users who have access to the plugin’s administration or form pages; the exploit path typically involves a crafted request that is sent when a user inadvertently visits a malicious site. Because the flaw is a CSRF, the attacker does not need to compromise the WordPress installation directly, but rather relies on user interaction.