CVE-2019-25734CWE-22

Contact Form by WD 1.13.1 CSRF to Local File Inclusion

Medium · published June 4, 2026

CVSS v4.0
5.1
EPSS
1%
Percentile
58.9
In the wild
Unconfirmed
What it is

Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting unsanitized action parameters. Attackers can craft malicious forms targeting the admin-ajax.php endpoint with directory traversal sequences in the GET action parameter to load files via CSRF, bypassing authentication on vulnerable AJAX actions.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
EPSS
0.00887 · 58.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-04T13:22Z
EPSS history
Timeline
  • 04 JUN 13:22Z
    Contact Form by WD 1.13.1 CSRF to Local File Inclusion
    cvelistv5