Contact Form by WPForms – Drag & Drop Form Builder for WordPress, CVE-2026-40764

CVE, Research URL: CVE-2026-40764
Home page URL: Security reports for Contact Form by WPForms – Drag & Drop Form Builder for WordPress
Application: Contact Form by WPForms – Drag & Drop Form Builder for WordPress
Published on: Apr 15, 2026
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through <= 1.10.0.2.
Affected versions: max 1.10.0.3.
Status: vulnerable