CVE-2025-13657

Name of the Vulnerable Software and Affected Versions HelpDesk contact form plugin for WordPress versions prior to 1.1.6

Description The HelpDesk contact form plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is a result of inadequate or absent nonce validation within the handle query args() function. An unauthenticated attacker could potentially modify the plugin’s license ID and contact form ID settings by crafting a malicious request and tricking a site administrator into performing an action, such as clicking a link.

Recommendations Update the HelpDesk contact form plugin to version 1.1.6 or later.