The WPForms – Easy Form Builder for WordPress plugin suffers from a CSRF vulnerability due to improper or missing nonce validation in the process_admin_ui function. This allows attackers to craft malicious requests that, when executed by an authenticated administrator, can delete WPForm logs without proper authorization. The vulnerability affects all versions up to 1.9.1.6 and does not require the attacker to have privileges, relying instead on social engineering to induce the administrator to trigger the action.

An attacker can cause an authenticated site administrator to unknowingly delete WPForm logs by exploiting the CSRF vulnerability. This results in loss of log data, which may hinder auditing or incident response efforts. There is no direct confidentiality or availability impact reported, and the vulnerability does not allow privilege escalation or code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking on untrusted links while logged into the WordPress admin interface. Implementing additional CSRF protections or nonce validation manually may help mitigate the risk.