CVE-2025-24772: Pay with Contact Form 7 CSRF Vulnerability

CVE-2025-24772 Overview

CVE-2025-24772 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the cmsMinds Pay with Contact Form 7 WordPress plugin. The flaw impacts all plugin versions up to and including 1.0.4. An attacker can trick an authenticated user into submitting a forged HTTP request that performs unintended state-changing operations on the WordPress site. Successful exploitation requires user interaction, typically through a crafted link or malicious webpage. The vulnerability was published to the National Vulnerability Database (NVD) on June 6, 2025.

Critical Impact
Attackers can force authenticated WordPress users to perform unintended actions within the Pay with Contact Form 7 plugin, resulting in limited integrity and availability impact.

Affected Products

cmsMinds Pay with Contact Form 7 plugin for WordPress
All plugin versions from initial release through 1.0.4
WordPress sites with the affected plugin installed and active

Discovery Timeline

2025-06-06 - CVE-2025-24772 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24772

Vulnerability Analysis

The vulnerability stems from missing or improper CSRF protection in state-changing actions exposed by the Pay with Contact Form 7 plugin. WordPress provides a nonce mechanism to defend against forged requests, but affected endpoints do not validate a valid nonce or verify request origin before executing sensitive operations.

An attacker crafts a malicious HTML page or link that, when visited by an authenticated WordPress user, triggers a request to a vulnerable plugin endpoint. Because the victim's browser automatically attaches session cookies, the target application processes the request as if the user submitted it intentionally. The attack requires user interaction, aligning with the UI:R component of the vulnerability's scoring.

The scope of impact is bounded: confidentiality is not directly affected, while integrity and availability can be affected in a limited manner depending on the actions the plugin exposes. This is consistent with CSRF weaknesses classified under [CWE-352].

Root Cause

The root cause is the absence of anti-CSRF tokens or insufficient token validation on plugin endpoints that modify server-side state. WordPress plugins are expected to call check_admin_referer() or wp_verify_nonce() before executing privileged operations. When these checks are missing, any authenticated session can be abused across origins.

Attack Vector

Exploitation occurs over the network and does not require attacker authentication. The attacker must convince a logged-in administrator or user with appropriate permissions to visit a page under attacker control. The malicious page then issues a forged request, such as a hidden form auto-submission or a background fetch() call, targeting the vulnerable plugin action on the victim's WordPress site.

No verified public exploit code is available. See the Patchstack WordPress Vulnerability advisory for technical details.

Detection Methods for CVE-2025-24772

Indicators of Compromise

Unexpected changes to Pay with Contact Form 7 plugin configuration or payment-related settings without a corresponding administrator action in audit logs.
HTTP POST or GET requests to plugin endpoints with Referer or Origin headers pointing to unrelated third-party domains.
Web server access logs showing state-changing plugin requests immediately following user navigation from an external site.

Detection Strategies

Review WordPress request logs for plugin admin actions that lack an associated _wpnonce parameter or arrive with mismatched Referer headers.
Correlate authenticated administrator sessions with off-hours or unattended activity on Pay with Contact Form 7 endpoints.
Deploy a web application firewall (WAF) rule to flag cross-origin submissions to WordPress admin-ajax.php or plugin-specific handlers.

Monitoring Recommendations

Enable WordPress audit logging to capture plugin setting changes with user, IP, and timestamp attribution.
Monitor administrator browser sessions and enforce shorter session lifetimes for privileged WordPress accounts.
Alert on outbound navigation from admin dashboards to untrusted external domains during active plugin management workflows.

How to Mitigate CVE-2025-24772

Immediate Actions Required

Update the Pay with Contact Form 7 plugin to a version later than 1.0.4 once a patched release is confirmed by the vendor.
If no fixed version is available, deactivate and remove the plugin from all affected WordPress installations.
Enforce least-privilege for WordPress accounts and require administrators to log out when not actively managing the site.

Patch Information

Refer to the Patchstack WordPress Vulnerability advisory for current patch status and vendor guidance. The advisory identifies versions through 1.0.4 as vulnerable.

Workarounds

Block cross-origin requests to WordPress administrative endpoints using a WAF or reverse proxy rule set that validates Origin and Referer headers.
Restrict access to wp-admin by source IP address for administrators whenever operationally feasible.
Require administrators to use dedicated browser profiles or isolated sessions when accessing the WordPress admin interface.

bash

# Example nginx configuration to restrict wp-admin by source IP
location ~ ^/wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}