Cross-Site Request Forgery in vcita Contact Form Plugin for WordPress

CVE-2023-2303

Summary

The Contact Form and Calls To Action plugin by vcita for WordPress is prone to Cross-Site Request Forgery due to a lack of nonce validation in the vcita-callback.php file. This vulnerability allows unauthenticated attackers to alter plugin settings and inject harmful JavaScript if they can deceive an administrator into executing a crafted request, for instance, by clicking a link. Website owners must take precautionary measures to secure their sites against potential exploitation.

References