This vulnerability in Contact Form by WPForms (wpforms-lite) allows CSRF attacks, which can cause unauthorized actions to be performed by authenticated users without their consent. The affected versions are from initial releases through 1.10.0.2. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality and integrity with no impact on availability. No vendor advisory or patch information is provided, and the plugin is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow attackers to perform unauthorized actions on behalf of authenticated users, leading to high confidentiality and integrity impacts. There is no indication of availability impact. No known exploits are reported in the wild, so the immediate risk may be limited but the vulnerability is serious due to the high CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting the use of the affected plugin version to reduce exposure. Monitor official Syed Balkhi or WPForms channels for updates and apply patches promptly once available.