The vulnerability is a Cross‑Site Request Forgery flaw in the Erik AntiSpam for Contact Form 7 plugin. It permits an attacker to craft a request that causes a legitimate authenticated user to unknowingly perform privileged actions on the site, potentially altering or deleting contact form entries or other settings. The weakness corresponds to CWE‑352, indicating missing or inadequate CSRF protection.

The issue affects the WordPress AntiSpam for Contact Form 7 plugin by Erik. Versions from any released version up through and including 0.6.3 are vulnerable. Administrators using any of these releases are at risk.

The published CVSS score of 5.4 represents moderate severity, and the EPSS score of less than 1 % suggests a low likelihood of widespread exploitation. The vulnerability is not currently listed in the CISA KEV catalog. An attacker would launch the attack from an external malicious site that lures a logged‑in user to submit a forged request to the vulnerable endpoint, taking advantage of the missing CSRF token.