The A WP Life Contact Form Widget (new-contact-form-widget) up to version 1.4.6 contains a CSRF vulnerability that enables attackers to perform unauthorized actions by exploiting the trust of an authenticated user. The vulnerability is network exploitable without privileges but requires user interaction. It impacts confidentiality with high severity but does not affect integrity or availability. The vulnerability is publicly disclosed with no known exploits reported.

Successful exploitation of this CSRF vulnerability could allow an attacker to perform actions on behalf of an authenticated user without their consent, potentially leading to unauthorized disclosure of sensitive information. The CVSS vector indicates a high impact on confidentiality but no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting widget usage to trusted environments if feasible.