The RD Contacto plugin for WordPress is vulnerable to cross‑site request forgery in all versions up to and including 1.4. Because the rdWappUpdateData() function lacks proper nonce validation, an attacker can forge a request and cause a logged‑in administrator to update plugin settings. This allows the attacker to modify configuration—potentially enabling malicious behavior—without needing valid credentials.

WordPress sites running the RD Contacto plugin by richarddev7, versions 1.4 and earlier, are affected. Any installation of this plugin without upgrading to a newer release is exposed.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% reflects a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires that the victim be an authenticated administrator who is tricked into visiting a crafted URL—typical of a CSRF attack. Because the attacker does not need to compromise credentials, the risk is present if social engineering succeeds, but the low EPSS suggests it is not a currently widely used vector.