Skip to content
OpenAdvisories
High · 8.1 CVE-2026-40764 EUVD-2026-22903

WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability

Published Apr 15, 2026 · Updated Apr 29, 2026 · Assigned by Patchstack

Vendor: Syed Balkhi Product: Contact Form by WPForms

Description

Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through <= 1.10.0.2.

Affected products

VendorProductAffectedFixed
Syed Balkhi Contact Form by WPForms ≤ 1.10.0.2 —

References