CVE-2025-13657: CSRF in HelpDesk Contact Form WordPress Plugin

The core of this vulnerability lies in the lack of proper nonce validation within the handlequeryargs() function. A CSRF attack exploits this by tricking an authenticated administrator into unknowingly executing a malicious request. Successful exploitation allows an attacker to modify critical plugin settings, such as the license ID and contact form ID. This could lead to unauthorized changes to the plugin's behavior, potentially disrupting contact form submissions, altering license information, or even disabling the plugin entirely. The impact is amplified if the plugin is heavily relied upon for customer communication or support.

1. Reserved2025-11-25
2. Published2026-01-07
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade the HelpDesk Contact Form plugin to version 1.1.6 or later. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider implementing temporary workarounds. While a direct WAF rule targeting the vulnerable endpoint might be possible, it's less effective than addressing the root cause. Carefully review any suspicious requests originating from external sources and restrict access to plugin configuration pages to trusted administrators only. Regularly audit plugin settings for unauthorized modifications.

Active installs

30

Plugin rating