A Cross‑Site Request Forgery vulnerability exists within the WordPress CformsII plugin that allows an attacker to force a logged‑in user to submit forms or perform other plugin‑related actions without the user’s consent. This flaw is coded as CWE‑352 and can be abused to alter or create content, manipulate form data, or otherwise trigger unintended processes within the site.

The vulnerability affects the bgermann CformsII plugin for WordPress version 15.1.3 and older. Any installation of the plugin up to and including this version is susceptible. An upgrade to version 15.1.4 or newer removes the flaw.

The CVSS score of 7.1 indicates a high overall risk. Exploit probability data (EPSS) is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation to date. The likely attack vector is web‑based: an attacker can host a malicious page that, when visited by an authenticated user, submits a CSRF request to the site leveraging the vulnerable plugin. If successful, the attacker could execute unintended form actions as the user, potentially leading to unauthorized data changes or content injection.