The Quick Contact Form plugin contains a Cross‑Site Request Forgery (CSRF) vulnerability that enables an attacker to forge form submissions on behalf of an authenticated site user. This weakness (CWE‑352) could result in the attacker posting unwanted content, modifying configuration data, or performing other privileged actions within the scope of the user’s access rights.

In WordPress sites, any installation of Saad Iqbal Quick Contact Form from a version before the release of 8.2.6 (i.e., 8.2.5 and earlier) is affected. All users who have logged into the site while the vulnerable plugin is active are at risk.

The CVSS score of 4.3 reflects a moderate impact. The EPSS score of less than 1% suggests that early exploitation is unlikely and no widespread public exploits are reported, as the vulnerability is not listed in the CISA KEV catalog. Exploitation typically requires that an authenticated user visits a crafted URL or interacts with a malicious link while their session is active. Because it is a typical CSRF scenario, the attack vector is inferred to be a user‑initiated request, often via a malicious webpage or email link.