WordPress Contact Forms by Cimatti <= 2.3.6 - Unauthenticated Insecure Direct Object Reference to Submitted File Download
- ID
- WPSEC-2026-1457
- Plugin
- Contact Forms by Cimatti (contact-forms)
- Affected
- all versions before 2.3.32
- Remediation
- Update to 2.3.32 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- WordPress Contact Forms by Cimatti on WPSec AttackSurface
- Fix released
- Published
Description
The Contact Forms by Cimatti plugin for WordPress is vulnerable to Insecure Direct Object Reference via the accua_forms_download_submitted_file AJAX action in all versions up to, and including, 2.3.6, due to downloads being authorized by a generic 'accua_forms_download_nonce' nonce instead of the submission's own secret token. For logged-out visitors this nonce is the same for everyone, and the plugin puts it into every file download link it builds while processing a submission. This makes it possible for unauthenticated attackers who receive such a link for their own submission, for example in an autoreply e-mail or success message that includes the submitted data, to download files uploaded with other visitors' submissions by changing the sequential submission ID, the field and the file name in the URL.
References
- https://wpsec.com/vuln/WPSEC-2026-1457/
- https://plugins.svn.wordpress.org/contact-forms/tags/2.3.32/
- https://wordpress.org/plugins/contact-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS