Contact Form Email <= 1.3.72 - Authenticated (Subscriber+) Missing Authorization to Form Management and Submission Data Access
- ID
- WPSEC-2026-2925
- Plugin
- Contact Form Email (contact-form-to-email)
- Affected
- all versions before 1.3.73
- Remediation
- Update to 1.3.73 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Contact Form Email on WPSec AttackSurface
- Fix released
- Published
Description
The Contact Form Email plugin for WordPress is vulnerable to unauthorized access via the plugin's Help and Referral admin submenu pages in all versions up to, and including, 1.3.72, due to these submenu pages being registered with the 'read' capability while the shared settings_page() callback performs no capability check and recognises the redirect-only pages by exact comparison of the raw 'page' parameter. A 'page' value with a trailing slash still loads the same submenu page but matches none of the redirect branches, so the request reaches the full admin interface, whose include files have no capability checks of their own. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view submitted messages and reports, and to create, rename, clone and delete contact forms and delete or import stored messages.
References
- https://wpsec.com/vuln/WPSEC-2026-2925/
- https://plugins.svn.wordpress.org/contact-form-to-email/tags/1.3.73/
- https://wordpress.org/plugins/contact-form-to-email/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS