The Responsive Contact Form Builder & Lead Generation Plugin for WordPress suffers from a CSRF vulnerability due to missing or incorrect nonce validation in multiple functions. This flaw allows unauthenticated attackers to craft malicious requests that, if executed by a site administrator, can trigger actions such as deleting forms, signing up leads, or uploading files. The vulnerability affects all plugin versions up to 1.8.9. The CVSS 3.1 base score is 4.3 (medium severity), reflecting that the attack requires user interaction (UI:R) but no privileges (PR:N) and impacts integrity with no confidentiality or availability impact.

An attacker can exploit this vulnerability by tricking an authenticated site administrator into clicking a malicious link or visiting a crafted webpage, causing unintended actions within the plugin such as form deletion, lead signup, or file upload. This can disrupt normal plugin operations and potentially introduce unwanted data or files. There is no indication of direct confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted links or websites while logged into WordPress with administrative privileges. Monitoring for plugin updates from themehunk is recommended to apply any forthcoming patches promptly.