The cForms – Light speed fast Form Builder plugin for WordPress suffers from a CSRF vulnerability due to improper nonce validation in the cforms_api function. This flaw enables attackers to craft forged requests that, when executed by an authenticated administrator (via social engineering like clicking a link), can modify form configurations without authorization. The vulnerability affects all plugin versions up to 3.0.0. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker can cause an authenticated site administrator to unknowingly modify forms and their settings by tricking them into executing a forged request. This could lead to unauthorized changes in form behavior or data collection, potentially impacting the integrity of form data. There is no direct impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should be cautious about clicking untrusted links and consider restricting administrative access or implementing additional CSRF protections at the web server or application firewall level. Monitoring for updates from the vendor (compojoom) is recommended.