Cotonti CVE-2026-93873

Exploitation requires an authenticated Cotonti victim (user logged into the site) to visit an attacker-controlled page while their session is active (CVSS UI:P), and requires the vulnerable contact plugin to be installed and its submission handler reachable. The attacker needs no credentials or privileges of their own (PR:N), but cannot act without the victim's browser and valid session. Limiting factors: the required user interaction, dependence on the contact plugin being enabled, and the low-impact outcome (forged messages to the admin inbox only - no data exposure or system compromise). Versions through 1.0.0 are affected; the fix (cot_check_xg() token check) is available from the vendor.

This is a genuine but modest-severity CSRF flaw (CWE-352) rated 5.3 by the vendor using CVSS 4.0. All exploitation signals point to LOW real-world priority. The 4.0 vector (AV:N/AC:L/PR:N/UI:P/VC:N/VI:L/VA:N) shows only limited integrity impact (VI:L) with no confidentiality or availability effect - consistent with the described outcome of forged contact-form messages, not code execution or data theft. No EPSS score, no CISA KEV listing, and no public exploit code (POC) were provided, so this is 'no public exploit identified at time of analysis.' The vector requires passive user interaction (UI:P): a victim must be logged in and lured to an attacker-controlled page, which materially limits reach versus a fully unauthenticated automatic attack. The vendor 5.3 rating and my independent assessment (~4.3 in CVSS 3.1 terms) are broadly aligned; no metrics are in conflict. Net: real, verifiable, patched, but low priority - the impact ceiling is spoofed inbox messages to the administrator, not compromise of the application.

An attacker hosts a web page containing a hidden, auto-submitting form that POSTs to the Cotonti contact plugin handler. When an authenticated victim visits that page, their browser silently submits the forged contact form, delivering a spoofed message attributed to the victim into the administrator's inbox. No public exploit code is available, but the technique is trivial and the missing token check (patched by adding cot_check_xg()) confirms the mechanism.