CVE-2024-10521 Overview
CVE-2024-10521 affects the Contact Forms by Cimatti plugin for WordPress in all versions up to and including 1.9.2. The vulnerability stems from missing or incorrect nonce validation in the process_bulk_action function. Unauthenticated attackers can delete forms through forged requests if they successfully trick a site administrator into clicking a malicious link. The flaw is classified under CWE-352: Cross-Site Request Forgery.
Critical Impact
Successful exploitation allows unauthenticated attackers to delete arbitrary contact forms managed by the plugin, causing integrity loss and disruption of site functionality.
Affected Products
- Cimatti WordPress Contact Forms plugin versions up to and including 1.9.2
- WordPress sites running the vulnerable contact-forms plugin
- Administrator-managed forms exposed through the plugin's bulk action interface
Discovery Timeline
- 2024-11-27 - CVE-2024-10521 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10521
Vulnerability Analysis
The vulnerability resides in the process_bulk_action function of the Contact Forms by Cimatti plugin. The function handles bulk operations such as deleting forms from the administrative interface. It fails to validate an anti-CSRF nonce token before executing the requested action.
WordPress provides wp_nonce_field() and check_admin_referer() primitives to prevent Cross-Site Request Forgery. When these controls are absent, the browser will attach the administrator's authenticated session cookies to any request originating from an attacker-controlled page. The plugin then processes the request as if the administrator had submitted it directly.
The attack requires user interaction from an authenticated administrator, limiting its impact to integrity of stored forms rather than full site compromise.
Root Cause
The root cause is a missing nonce verification check in the bulk action handler defined in accua-forms-list-page.php. Refer to the WordPress Plugin Code Review and the WordPress Change Set 3196728 for the patched code.
Attack Vector
An attacker crafts an HTML page or email containing a request that triggers the plugin's bulk delete action. When an authenticated WordPress administrator visits the attacker-controlled resource, the browser submits the forged request with valid session cookies. The plugin executes the deletion because it does not verify a nonce or referer.
No verified proof-of-concept code is publicly available. See the Wordfence Vulnerability Report for additional analysis.
Detection Methods for CVE-2024-10521
Indicators of Compromise
- Unexpected deletion of contact forms configured through the Cimatti plugin
- Administrator web sessions with Referer headers pointing to external, untrusted domains immediately preceding form deletions
- POST requests to plugin admin endpoints lacking the expected _wpnonce parameter
Detection Strategies
- Review WordPress audit logs for form deletion events correlated with administrator browsing activity
- Inspect web server access logs for requests targeting the plugin's list page containing bulk action parameters from off-site referers
- Monitor for administrator actions occurring shortly after clicks on external links delivered via email or messaging platforms
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record administrative changes including plugin data deletions
- Forward WordPress and web server logs to a centralized SIEM for correlation and alerting
- Alert on outbound HTTP referers from administrator sessions immediately preceding state-changing plugin actions
How to Mitigate CVE-2024-10521
Immediate Actions Required
- Update the Contact Forms by Cimatti plugin to a version later than 1.9.2 that includes the fix from WordPress Change Set 3196728
- Audit existing contact forms and backups to confirm no unauthorized deletions have occurred
- Instruct administrators to log out of WordPress sessions before browsing untrusted content
Patch Information
The vendor addressed the vulnerability in a code change published as WordPress Change Set 3196728. The patch adds nonce validation to the process_bulk_action function. Users should upgrade through the WordPress plugin dashboard or download the latest release from the WordPress Plugin Developer Page.
Workarounds
- Deactivate the Contact Forms by Cimatti plugin until the patched version is installed
- Restrict WordPress administrator access to dedicated browsers or profiles isolated from general web browsing
- Deploy a web application firewall rule to block requests to the plugin's admin endpoints that lack a valid _wpnonce parameter
# Update the plugin using WP-CLI
wp plugin update contact-forms
wp plugin list --name=contact-forms --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
