CVE-2026-48835: WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability

Synopsis

This is a broken access control vulnerability in the Contact Form by WPForms WordPress plugin, affecting versions 1.10.0.4 and earlier. The flaw is reachable over the network with no authentication required and no user interaction needed, meaning any external attacker can trigger the vulnerable code path directly. Successful exploitation allows an attacker to tamper with data, achieving high integrity impact on the affected system. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the target WordPress installation.

• AuthenticationNot required

  No account or credentials of any privilege level are needed to reach the vulnerable code path.

• Victim interactionNot required

  The attack is fully automated and does not require any action from an administrator or site visitor.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions or special environmental factors required.

Blast Radius

• An attacker can modify form data, form configurations, or other persisted plugin state without holding any account on the site.
• Because access controls are bypassed entirely, the attacker may be able to alter or delete contact form submissions or plugin settings.
• Integrity of data managed by the WPForms plugin is fully compromised; confidentiality and availability of the broader WordPress installation are not directly affected by this vector.