Medium severity4.3NVD Advisory· Published Sep 18, 2026

CVE-2026-93873

Description

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox.

Patches

Vulnerability mechanics

References

github.com/Cotonti/Cotonti/blob/1.0.0/plugins/contact/contact.phpnvd
github.com/Cotonti/Cotonti/issues/1895nvd
github.com/Cotonti/Cotonti/pull/1903nvd
www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-in-the-contact-pluginnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000