The cForms – Light speed fast Form Builder plugin for WordPress is affected by an absence or incorrect nonce validation in its cforms_api function. This flaw permits a malicious actor who sends a forged HTTP request to modify form definitions and their settings, an action that requires an administrator to unknowingly click a crafted link or perform a similar action. The impact is the potential unauthorized alteration of site forms, which can lead to misinformation, defacement, or other integrity violations. The weakness corresponds to CWE‑352 – Cross‑Site Request Forgery.

The vulnerability exists in all published releases of compojoom's cForms – Light speed fast Form Builder up to and including version 3.0.0. Users operating those versions should verify the exact edition number and plan remediation.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1% suggests exploitation is unlikely at the current time. The flaw is not listed as a known exploited vulnerability by CISA (not in KEV). Based on the description, the likely attack vector is a normal web request from an attacker that the site administrator executes unknowingly. This requires the attacker to entice an authenticated administrator to click a malicious link, after which the forged request modifies the form settings.