Cross-Site Request Forgery Vulnerability in Professional Contact Form Plugin by WordPress

CVE-2025-9944

What is CVE-2025-9944?

The Professional Contact Form plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit Cross-Site Request Forgery (CSRF) due to improper nonce validation in the watch_for_contact_form_submit function. This flaw enables the attacker to send unauthorized test emails by tricking a site administrator into clicking a malicious link, thus executing actions without their consent. It highlights the necessity of robust nonce validation to prevent such security breaches.

References