# Contact Form Email <= 1.3.72 - Authenticated (Subscriber+) Missing Authorization to Form Management and Submission Data Access

- **ID:** WPSEC-2026-2925
- **Plugin:** Contact Form Email (`contact-form-to-email`), https://wordpress.org/plugins/contact-form-to-email/
- **Affected versions:** all versions before 1.3.73
- **Fixed in:** 1.3.73 (Update to 1.3.73 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/contact-form-to-email
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2925/

## Description

The Contact Form Email plugin for WordPress is vulnerable to unauthorized access via the plugin's Help and Referral admin submenu pages in all versions up to, and including, 1.3.72, due to these submenu pages being registered with the 'read' capability while the shared settings_page() callback performs no capability check and recognises the redirect-only pages by exact comparison of the raw 'page' parameter. A 'page' value with a trailing slash still loads the same submenu page but matches none of the redirect branches, so the request reaches the full admin interface, whose include files have no capability checks of their own. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view submitted messages and reports, and to create, rename, clone and delete contact forms and delete or import stored messages.

## References

- https://wpsec.com/vuln/WPSEC-2026-2925/
- https://plugins.svn.wordpress.org/contact-form-to-email/tags/1.3.73/
- https://wordpress.org/plugins/contact-form-to-email/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2925/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.