The Contact Forms by Cimatti WordPress plugin suffers from a CSRF vulnerability due to improper nonce validation in the process_bulk_action function. This flaw enables attackers to perform unauthorized form deletions if they can deceive an authenticated site administrator into executing a crafted request. The vulnerability affects all plugin versions up to and including 1.9.2. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and requiring user interaction.

An attacker can cause a site administrator to unknowingly delete contact forms by exploiting the CSRF vulnerability. This results in limited impact to integrity (form deletion) but no direct confidentiality or availability impact is indicated. The vulnerability requires user interaction (the administrator must be tricked into clicking a malicious link). There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links while logged into WordPress and consider disabling or restricting access to the affected plugin's bulk action features. Monitor the vendor's communications for updates and apply any official patches once released.