Threats tagged 'ghsa-2663-mp38-cxqg'

The Contact Form by Supsystic WordPress plugin versions before 1.11.1 lack validation of CSRF tokens or request origin on two administrator-only actions: bulk deletion of captured form submissions and wiping a form's statistics. This vulnerability allows attackers to trick logged-in administrators into sending forged requests that permanently delete stored contact leads and analytics data.