CVE-2026-93873

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0

Description The contact plugin submission handler fails to validate anti-CSRF tokens. This allows attackers to use attacker-controlled pages to auto-submit contact forms, sending forged messages to the administrator inbox that appear to be from authenticated victims. Cross-Site Request Forgery (CSRF) is a technique where a malicious website causes a user's web browser to perform an unwanted action on a different website where the user is currently authenticated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.