The Professional Contact Form plugin for WordPress contains a Cross‑Site Request Forgery flaw caused by missing or incorrect nonce validation in the watch_for_contact_form_submit handler. An unauthenticated attacker can force a site administrator to unknowingly trigger the plugin’s test‑email function, causing the server to send emails to arbitrary addresses. This allows the attacker to generate spam or phishing messages from the legitimate site, potentially damaging the site’s reputation and abusing its mail server. The weakness corresponds to CWE‑352.

The vulnerability affects the kelderic Professional Contact Form plugin for WordPress, in all released versions up to and including 1.0.0. The plugin is available for download and installation from the WordPress plugin repository.

The CVSS score is 4.3, indicating a medium impact level. The EPSS score is less than 1 %, suggesting a very low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to lure a site administrator into clicking a crafted link or submitting a forged request; no network‑level exposure is needed. Because the vulnerability is limited to an admin action, the overall risk is moderate, but organizations with active users might still suffer email reputation damage if an attack succeeds.