CVE-2026-48835

Vulnerability

A broken access control vulnerability exists in the Contact Form by WPForms plugin for WordPress, affecting versions up to and including 1.10.0.4. The issue stems from missing authorization or nonce token checks in certain functions, enabling unauthenticated users to access or execute actions intended for higher-privileged users [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted requests to the vulnerable plugin endpoints. No authentication or prior knowledge is required, and the attack can be scaled to target thousands of websites simultaneously [1].

Impact

Successful exploitation allows an attacker to perform privileged actions without authorization, potentially leading to unauthorized data access, modification of form configurations, or other administrative capabilities. The vulnerability is actively used in mass-exploit campaigns, posing a significant risk to any site running the plugin [1].

Mitigation

Official patch: upgrade to version 1.10.0.5 or later immediately. The update restores proper access control checks. Users unable to update immediately should consider disabling the plugin or contacting their hosting provider for assistance. Auto-update can be enabled for vulnerable plugins via Patchstack [1].