The Contact Form by Supsystic WordPress plugin suffers from a CSRF vulnerability (CWE-79) in all versions up to 1.7.29. The issue stems from missing or incorrect nonce validation on the saveAsCopy function, which is used to save a copy of settings. This allows an attacker to craft a forged request that, if executed by an authenticated administrator (via user interaction such as clicking a link), can update plugin settings and inject malicious web scripts. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to perform actions with administrator privileges by tricking the admin into clicking a malicious link. This can lead to unauthorized modification of plugin settings and injection of malicious scripts, potentially compromising site confidentiality and integrity. Availability is not impacted. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links and consider disabling or restricting access to the saveAsCopy function if possible. Monitor for updates from the plugin vendor and apply patches promptly once released.