The vulnerability is a CSRF flaw that allows an authenticated administrator to modify the plugin's outbound mail configuration. By directing the admin to a crafted URL, the attacker can change the SMTP server, credentials, and recipient addresses. This change can redirect all contact form notifications to a mail server under the attacker's control, enabling phishing, data exfiltration, or further exploitation through email channels.

The flaw affects WordPress sites running the Contact Form by Supsystic plugin version 1.11.0 and earlier. The plugin is available from the WordPress plugin repository and is commonly installed on numerous sites. Administrators who are logged in and have permission to update plugin settings are susceptible.

The attack requires the victim to be an authenticated administrator who visits a malicious link, which attackers can embed in emails, social media, or malicious sites. No public exploit code is listed, but the lack of a CSRF nonce means the exploit can be triggered manually or automatically via cross-site requests. The EPSS score is currently unavailable, and the vulnerability is not in CISA KEV, but the potential for widespread mail configuration hijacking and subsequent phishing campaigns makes the risk significant for sites that use external SMTP services.