CVE-2019-25734

Name of the Vulnerable Software and Affected Versions Contact Form by WD version 1.13.1

Description An issue exists where unauthenticated attackers can include arbitrary files by exploiting unsanitized action parameters. This is achieved through a combination of cross-site request forgery (CSRF)—a technique that forces a user to execute unwanted actions on a web application—and local file inclusion (LFI), which allows the loading of files from the local server. Attackers can craft malicious forms targeting the 'admin-ajax.php' endpoint using directory traversal sequences in the action GET parameter to load files and bypass authentication on vulnerable AJAX actions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.