CVE-2026-93873: Cotonti Contact Plugin CSRF Vulnerability

CVE-2026-93873 Overview

CVE-2026-93873 is a Cross-Site Request Forgery (CSRF) vulnerability in the Cotonti content management system through version 1.0.0. The contact plugin submission handler fails to validate anti-CSRF tokens, allowing attackers to forge contact messages on behalf of authenticated users. An attacker hosts a malicious page that auto-submits a crafted contact form. When an authenticated Cotonti user visits that page, the browser submits the request with the victim's session cookies. The administrator inbox then receives a forged message attributed to the victim. The vulnerability is tracked under CWE-352.

Critical Impact
Attackers can forge contact messages attributed to authenticated Cotonti users, delivering fraudulent content to administrator inboxes without the victim's consent.

Affected Products

Cotonti CMS versions through 1.0.0
The contact plugin bundled with Cotonti
Deployments referenced in the Cotonti GitHub repository

Discovery Timeline

2026-09-18 - CVE-2026-93873 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93873

Vulnerability Analysis

The flaw resides in the contact plugin submission handler located at plugins/contact/contact.php. The handler processes incoming POST requests to send messages to the site administrator without verifying an anti-CSRF token. Cotonti includes a token framework (sed_check_xg) used elsewhere in the application, but the contact submission path omits this check. Any authenticated user session can therefore be reused by a third-party origin to submit forged messages. See the VulnCheck advisory and GitHub Issue #1895 for the disclosure details.

Root Cause

The submission handler accepts POST parameters and dispatches the message without invoking Cotonti's CSRF token validation function. Because state-changing operations require only session cookies for authorization, the browser's automatic cookie attachment satisfies the check. The result is a classic CWE-352 pattern where request authenticity is never verified.

Attack Vector

Exploitation requires user interaction: an authenticated Cotonti user must visit an attacker-controlled page. That page contains a hidden HTML form targeting the Cotonti contact endpoint and submits it via JavaScript on page load. The forged submission arrives at the administrator inbox attributed to the victim, enabling impersonation, social engineering setups against administrators, and reputation damage against the impersonated user.

No verified proof-of-concept code is published. The mechanism is described in prose per the Cotonti Pull Request #1903 that introduces the fix.

Detection Methods for CVE-2026-93873

Indicators of Compromise

Contact form submissions in administrator inboxes with Referer or Origin headers pointing to external, unrelated domains.
Bursts of contact messages from distinct authenticated users within short time windows.
Contact submissions where the message body contains suspicious payloads, phishing links, or content inconsistent with the attributed user's history.

Detection Strategies

Inspect web server access logs for POST requests to plugins/contact/contact.php with cross-origin Referer values.
Correlate submission timestamps with user session activity to flag messages sent while users were not actively browsing the Cotonti site.
Deploy a Web Application Firewall (WAF) rule that blocks state-changing POST requests to the contact endpoint when the Origin header does not match the site's own domain.

Monitoring Recommendations

Enable verbose logging on the contact plugin endpoint, capturing headers, source IP, and authenticated user ID.
Alert on repeated administrator inbox entries originating from a small set of external referrers.
Route Cotonti web logs into a centralized analytics platform to baseline normal contact submission volumes and detect anomalies.

How to Mitigate CVE-2026-93873

Immediate Actions Required

Apply the upstream fix from Cotonti Pull Request #1903 or upgrade to a Cotonti release that includes the CSRF token check in the contact plugin.
Audit administrator inboxes for suspicious messages received before the patch was applied.
Notify users whose accounts may have been leveraged in forged submissions.

Patch Information

The fix is tracked in GitHub Issue #1895 and delivered by Pull Request #1903 in the Cotonti repository. The patch adds anti-CSRF token generation in the contact form and validation in the contact submission handler. Administrators running Cotonti 1.0.0 or earlier should update to the patched release.

Workarounds

Temporarily disable the contact plugin from the Cotonti administrator panel until the patch is applied.
Configure the web server or reverse proxy to reject POST requests to the contact endpoint when the Origin or Referer header does not match the site's canonical domain.
Set session cookies with the SameSite=Lax or SameSite=Strict attribute to prevent cross-site cookie attachment for the vulnerable endpoint.

bash

# Nginx snippet: block cross-origin POSTs to the contact endpoint
location /plugins/contact/contact.php {
    if ($request_method = POST) {
        set $origin_ok 0;
        if ($http_origin ~* "^https?://(www\.)?example\.com$") { set $origin_ok 1; }
        if ($origin_ok = 0) { return 403; }
    }
}