Is CVE-2023-25969 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-25969 being exploited in the wild.

How severe is CVE-2023-25969?

Medium severity, with a CVSS score of 5.4, published 11 June 2026.

Is there a fix for CVE-2023-25969?

A patch was published on 2026-06-11: NVD publication date (Note: Patch version 1.8.5 was available earlier) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-25969 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-25969?

Check whether you run ThemeHunk Contact Form & Lead Form Elementor Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-25969: ThemeHunk Contact Form & Lead Form Elementor Builder missing authorization

CVE-2023-25969 · Severity: medium · CVSS 5.4 · Published 2026-06-11

The ThemeHunk Contact Form & Lead Form Elementor Builder plugin for WordPress, which helps users create custom contact and lead generation forms, contains a security flaw in its access control settings. An attacker could potentially trick a site administrator into performing unintended actions, such as modifying form settings or deleting data, by getting them to click a malicious link. This could lead to unauthorized changes to how the website collects lead information or disrupt the site's contact functionality.

Vendors: ThemeHunk.

Quick answers

Is CVE-2023-25969 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-25969 being exploited in the wild.
How severe is CVE-2023-25969?: Medium severity, with a CVSS score of 5.4, published 11 June 2026.
Which products and versions are affected?: ThemeHunk Contact Form & Lead Form Elementor Builder <= 1.8.4.
Is there a fix for CVE-2023-25969?: A patch was published on 2026-06-11: NVD publication date (Note: Patch version 1.8.5 was available earlier) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-25969 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-25969?: Check whether you run ThemeHunk Contact Form & Lead Form Elementor Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in the ThemeHunk Contact Form & Lead Form Elementor Builder plugin for WordPress through version 1.8.4. The vulnerability stems from incorrectly configured access control security levels and a lack of proper nonce validation, effectively making it susceptible to Cross-Site Request Forgery (CSRF). An unauthenticated remote attacker can exploit this by inducing a privileged user (such as an administrator) to interact with a specially crafted link or page. Successful exploitation allows the attacker to execute administrative actions or modify plugin settings without proper authorization. The issue is resolved in version 1.8.5.

Affected products

ThemeHunk Contact Form & Lead Form Elementor Builder <= 1.8.4

Timeline

2022-09-10: disclosed: Reported by István Márton
2023-06-27: advisory: Initial advisory published by Patchstack
2026-06-11: patched: NVD publication date (Note: Patch version 1.8.5 was available earlier)

References

https://patchstack.com/database/wordpress/plugin/lead-form-builder/vulnerability/wordpress-contact-form-lead-form-elementor-builder-plugin-1-8-4-cross-site-request-forgery-csrf?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.