PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40764 Syed Balkhi CVE debrief

A Cross-Site Request Forgery (CSRF) vulnerability exists in Contact Form by WPForms wpforms-lite from n/a through <= 1.10.0.2. This issue allows for Cross Site Request Forgery. Defenders responsible for maintaining and securing WordPress installations using the Contact Form by WPForms plugin should assess their exposure and take necessary actions to prevent potential CSRF attacks. The CVE record and NVD entry provide details on the CSRF vulnerability in Contact Form by WPForms wpforms-lite. However, further verification is needed to determine the full scope of affected versions and potential impacts. The vulnerability could lead to unauthorized actions on the affected plugin.

Vendor
Syed Balkhi
Product
Contact Form by WPForms
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-15
Original CVE updated
2026-10-26
Advisory published
2026-04-15
Advisory updated
2026-10-26

Who should care

Defenders responsible for maintaining and securing WordPress installations using the Contact Form by WPForms plugin should assess their exposure and take necessary actions to prevent potential CSRF attacks.

Why it matters

Defenders should prioritize verifying and updating the Contact Form by WPForms plugin to prevent potential CSRF attacks. This issue allows for Cross Site Request Forgery, which could lead to unauthorized actions on the affected plugin. Defenders responsible for maintaining and securing WordPress installations using this plugin should assess their exposure and take necessary actions.

  • Defenders need to verify and update the plugin to prevent potential CSRF attacks.
  • CSRF attacks could lead to unauthorized actions on the affected plugin.

Technical summary

A Cross-Site Request Forgery (CSRF) vulnerability exists in Contact Form by WPForms wpforms-lite from n/a through <= 1.10.0.2. This issue allows for Cross Site Request Forgery. The vulnerability could lead to unauthorized actions on the affected plugin. Defenders should prioritize verifying and updating the Contact Form by WPForms plugin to prevent potential CSRF attacks.

Defensive priority

Defenders should prioritize verifying and updating the Contact Form by WPForms plugin to prevent potential CSRF attacks.

Recommended defensive actions

  • Verify and update the Contact Form by WPForms plugin to the latest version.
  • Implement CSRF protection measures for the plugin.
  • Monitor for potential CSRF attacks targeting the plugin.

Evidence notes

The CVE record and NVD entry provide details on the CSRF vulnerability in Contact Form by WPForms wpforms-lite. However, further verification is needed to determine the full scope of affected versions and potential impacts.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40764 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40764

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40764 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40764

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.