CVE-2025-47491: WordPress Contact Form Widget plugin <= 1.4.6 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget allows Cross Site Request Forgery. This issue affects Contact Form Widget: from n/a through 1.4.6.
Other sources
Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through <= 1.4.6.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47491?
CVE-2025-47491 is classified as a medium severity vulnerability due to its potential for exploitation via Cross-Site Request Forgery.
How do I fix CVE-2025-47491?
To fix CVE-2025-47491, update the WordPress Contact Form Widget to version 1.4.7 or later.
What is the impact of CVE-2025-47491 on my website?
The impact of CVE-2025-47491 could lead to unauthorized actions being performed on behalf of a logged-in user, compromising the website's security.
Which versions of the WordPress Contact Form Widget are affected by CVE-2025-47491?
CVE-2025-47491 affects all versions of the WordPress Contact Form Widget up to and including version 1.4.6.
Is it necessary to implement additional security measures after fixing CVE-2025-47491?
Yes, it is advisable to implement additional security measures such as using CSRF tokens in forms to prevent future vulnerabilities.