CVE-2024-10521

The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on the process_bulk_action function. This makes it possible for unauthenticated attackers to delete forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/contact-forms/trunk/accua-forms-list-page.php#L154Patch
• https://plugins.trac.wordpress.org/browser/contact-forms/trunk/accua-forms-submissions-page.php#L348Product
• https://plugins.trac.wordpress.org/changeset/3196728/Patch
• https://wordpress.org/plugins/contact-forms/#developersProduct
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f86e8ccb-a865-4da5-9250-dd715b8cdbe7?source=cveThird Party Advisory

Published

Nov 27, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-10516The Swift Performance Lite plugin for WordPress is vulnerabl…8.1
• CVE-2024-10517The Paid Membership Plugin, Ecommerce, User Registration For…4.8
• CVE-2024-10518The Paid Membership Plugin, Ecommerce, User Registration For…4.8
• CVE-2024-10519The Wishlist for WooCommerce: Multi Wishlists Per Customer P…6.1
• CVE-2024-1052Boundary and Boundary Enterprise (“Boundary”) is vulnerable …8
• CVE-2024-10520The WP Project Manager plugin for WordPress is vulnerable to…5.3
• CVE-2024-10522The Co-marquage service-public.fr plugin for WordPress is vu…6.1
• CVE-2024-10523This vulnerability exists in TP-Link IoT Smart Hub due to st…4.6
• CVE-2024-10524Applications that use Wget to access a remote resource using…6.5
• CVE-2024-10525In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if …9.8
• CVE-2024-10526Rapid7 Velociraptor MSI Installer versions below 0.73.3 suff…8.6
• CVE-2024-10527The Spacer plugin for WordPress is vulnerable to unauthorize…3.1