Read the docs
TI-2019-15784 Aliases CVE-2019-25734GHSA-xggr-8f99-gpgj

Contact Form by WD 1.13.1 CSRF to Local File Inclusion

Priority LOW 25CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting unsanitized action parameters. Attackers can craft malicious forms targeting the admin-ajax.php endpoint with directory traversal sequences in the GET action parameter to load files via CSRF, bypassing authentication on vulnerable AJAX actions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00887 59th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Web-DoradoContact Form Maker1.13.1—No fix listedCNA
  • Contact Form Maker VendorWeb-Dorado Affected 1.13.1 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-25734
  2. 2026-10-03 Alias added: GHSA-xggr-8f99-gpgj

References

Exploit 1

Other 2

  • TI-2023-02483 Contact Form by WD <= 1.13.23 - Admin+ SQLi CVSS 3.1HIGH 7.2
  • TI-2018-15572 WordPress Contact Form Maker Plugin 1.12.20 SQL Injection CVSS 4.0HIGH 7.1
  • TI-2015-02251 Multiple SQL injection vulnerabilities in the Web-Dorado ECommerce WD (com_ecommercewd)… CVSS 2.0HIGH 7.5
  • TI-2015-02471 SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote… CVSS 3.0CRITICAL 9.8
  • TI-2018-04360 SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or… CVSS 3.0CRITICAL 9.8
  • TI-2018-04350 SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter. CVSS 3.0CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences