Cross-Site Request Forgery Vulnerability in Contact Form Builder by vcita for WordPress

CVE-2023-2301

Summary

The Contact Form Builder by vcita plugin for WordPress is susceptible to Cross-Site Request Forgery due to insufficient nonce validation in the ls_parse_vcita_callback function. This vulnerability allows unauthenticated attackers to manipulate plugin settings and inject harmful JavaScript by deceiving an administrator into executing an unintended action, such as clicking a malicious link. It highlights the critical need for robust verification mechanisms to prevent exploits that can compromise website integrity.

References