QSearchQSearch

CVE-2019-25734

4.0 MEDIUM

Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthentica...

Published: 2026-06-04 · Last updated: 2026-06-04

Severity and scoring

CVSS
4.0 MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
CWE-22

Description

Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting unsanitized action parameters. Attackers can craft malicious forms targeting the admin-ajax.php endpoint with directory traversal sequences in the GET action parameter to load files via CSRF, bypassing authentication on vulnerable AJAX actions.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-47368 — A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to ob... (8.6 HIGH)
  • CVE-2026-45171 — Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to ...
  • CVE-2025-24268 — A parsing issue in the handling of directory paths was addressed with improved path validation (5.5 MEDIUM)
  • CVE-2026-49982 — tmp is a temporary file and directory creator for node.js (8.2 HIGH)
  • CVE-2026-44705 — tmp is a temporary file and directory creator for node.js