CVE-2026-48835: Unauthenticated Access Control Flaw in WPForms Contact Forms

Technical summary

CVE-2026-48835 is an unauthenticated broken access control vulnerability (CWE-862) in Contact Form by WPForms up to version 1.10.0.4. The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible attack requiring no privileges or user interaction, with high integrity impact but no confidentiality or availability impact. The vulnerability permits unauthorized modification of contact form data and configurations without prior authentication, likely stemming from insufficient authorization checks on form-related API endpoints or administrative functions.

Business impact

Organizations relying on WPForms contact forms for customer inquiries, lead capture, or critical business communications face data integrity risks. Attackers can alter form submissions, inject malicious content, or corrupt legitimate contact records. This undermines trust in submitted data, complicates compliance audits, and can disrupt workflows dependent on accurate form capture. For businesses using WPForms as a primary contact mechanism, the inability to trust form integrity has immediate operational consequences.

Affected systems

All WordPress installations running Contact Form by WPForms version 1.10.0.4 or earlier are vulnerable. This includes sites using WPForms as a standalone contact form plugin or integrated into broader form management workflows. The vulnerability affects both single-site and multi-site WordPress deployments with the affected plugin versions active.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no special configuration, and can be triggered via simple HTTP requests from the public internet. The low attack complexity and absence of user interaction requirements mean that automated scanning and exploitation at scale are trivial. No specialized tools or deep plugin knowledge is necessary for an attacker to begin modifying form data.

Remediation

Immediately update Contact Form by WPForms to a version newer than 1.10.0.4. Verify the patch version against the official WPForms advisory or plugin repository to confirm the security update has addressed CWE-862. After patching, audit form submissions and settings for unauthorized modifications made during the vulnerability window. Consider temporarily disabling WPForms contact forms on production sites until patching is confirmed complete.

Patch guidance

1. Log into your WordPress admin dashboard and navigate to Plugins → Installed Plugins. 2. Locate 'Contact Form by WPForms' and check its current version. 3. If version is 1.10.0.4 or earlier, click 'Update now' to apply the latest patch. 4. Verify the new version number matches the patched release (verify against vendor advisory). 5. Test contact forms in a staging environment before confirming on production. 6. Document the patching date and version number for compliance records.

Detection guidance

Monitor web server and WordPress logs for suspicious POST/GET requests to form-related endpoints (typically /wp-admin/admin-ajax.php with form action parameters). Look for requests lacking valid nonces, session tokens, or authentication headers that successfully modify form data. Enable WordPress security logging plugins to capture unauthorized form submissions. Check form submission history for anomalous entries created outside normal business hours or from unexpected IP addresses. Review contact form settings and saved submissions for unexpected changes.

Why prioritize this

This vulnerability merits urgent patching due to the combination of high CVSS score (7.5), zero authentication requirements, and network accessibility. The integrity impact on form data directly affects business operations. Unlike vulnerabilities requiring user interaction or valid credentials, this flaw can be exploited immediately and at scale against any exposed WPForms instance. The lack of confidentiality impact prevents it from being critical, but the integrity breach justifies immediate remediation.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction needed (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), high integrity impact (I:H), and no availability impact (A:N). The HIGH severity is driven by the trivial exploit path and significant integrity damage, though lack of data exposure and system availability impact prevent a critical rating.

Frequently asked questions