Executive brief
Contact Form by WD is a popular WordPress plugin used to create and manage website contact forms. A security flaw allows attackers to trick a site administrator into loading unintended files from the server or potentially executing malicious code. This could lead to unauthorized access to sensitive server files or a compromise of the website's integrity.
Technical details
The vulnerability exists in the 'form_maker_ajax_fmc' function, which dynamically loads files based on the 'action' parameter from GET or POST requests without proper sanitization. By crafting a request to the 'admin-ajax.php' endpoint, an attacker can use directory traversal sequences (e.g., ../) in the GET 'action' parameter while providing a valid AJAX action in the POST body. This allows an unauthenticated attacker to bypass authentication checks on AJAX actions and perform Local File Inclusion (LFI). While the attack is primarily described as CSRF-driven, the lack of nonces and the availability of 'nopriv' AJAX actions also allow for direct exploitation in some configurations. The plugin has been permanently closed on the WordPress repository as of June 2023.
Affected products
- 10Web (formerly Web-Dorado) Contact Form Maker (Contact Form by WD) <= 1.13.1
Timeline
- 2019-03-17: disclosed: Vulnerability discovered by Panagiotis Vagenas
- 2019-04-05: other: Exploit published on Exploit-DB
- 2023-06-15: other: Plugin permanently closed on WordPress.org at author request
- 2026-06-04: advisory: CVE-2019-25734 published