Threats tagged 'ghsa-r32v-cmjq-6cp5'

The Contact Form by Supsystic WordPress plugin versions before 1.11.1 lack verification of a CSRF nonce when saving mail settings. This vulnerability allows an attacker to trick a logged-in administrator into visiting a crafted page, resulting in the overwriting of the site's outbound mail configuration, including SMTP server details, credentials, and notification recipients. This can enable the attacker to route contact form notifications through infrastructure they control.