The vulnerability is a Cross‑Site Request Forgery flaw that permits an attacker to compel an authenticated user of a WordPress site to send arbitrary form submissions or alter form settings. By exploiting the missing CSRF token validation, an attacker can trigger unintended actions that compromise the integrity and confidentiality of user data or website configuration. The weakness corresponds to CWE‑352, which concerns lacking protection against cross‑site request forgery.

The issue affects installations of the WordPress plugin Contact Form by WPForms from Syed Balkhi, including any version through 1.10.0.2. Any WordPress site that has this plugin installed and runs a vulnerable version is susceptible. No specific operating‑system or PHP version constraints are listed.

The CVSS score is 8.1, and the EPSS score is less than 1%. This vulnerability is not listed in the KEV catalog. Exploitation requires an attacker to lure an authenticated user to a crafted URL or form, making the attack vector HTTP. Because no active exploitation code is reported and the defect plays on authenticated sessions, the risk is moderate, but sites with high‑value content or exposed configuration panels should prioritize remediation.