Contact Form Email EUVD-2026-15825

Although CVSS and EPSS scores are not provided, the CWE-862 classification (Missing Authorization) combined with the 'Authentication Bypass' tag indicates this is a critical vulnerability with high real-world risk. Missing authorization vulnerabilities typically have low attack complexity and require no privileges or user interaction, making them frequently exploitable. The fact that Patchstack reported this and it received an ENISA EUVD ID (EUVD-2026-15825) signals institutional recognition of severity. The version constraint (through 1.3.63 with unclear initial affected version) suggests a widespread exposure window. Without explicit KEV or POC data in the intelligence, we assess this as a high-priority issue warranting immediate patching due to the permission bypass nature and WordPress plugin ubiquity; however, real-world impact depends on whether the plugin is widely deployed and whether threat actors have weaponized the flaw.

An unauthenticated attacker or low-privileged WordPress user could craft requests directly to the Contact Form Email plugin's administrative functions, bypassing authorization checks due to missing capability verification. For example, the attacker could modify form configurations, redirect email submissions to an attacker-controlled address, or extract sensitive contact form data without possessing the required WordPress administrator role. Because the vulnerability is classified as a missing authorization flaw (not requiring valid credentials), exploitation could occur remotely without user interaction, making it straightforward for attackers to automate discovery and exploitation across multiple WordPress installations.