CVE-2026-93873: Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin
Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox.
Affected Software
Event History
Frequently Asked Questions
Who can be targeted by this issue?
Authenticated Cotonti users who can submit the contact form can be induced to send a forged message to the administrator inbox. The attacker does not need an account, but must cause a victim to visit an attacker-controlled page.
What is the practical impact of successful exploitation?
An attacker can cause contact-form messages to be sent with the authenticated victim attributed as the sender. The reported impact is limited to message forgery and integrity; no confidentiality or availability impact is specified.
How can I determine whether an installation is affected?
Cotonti versions through 1.0.0 are identified as affected when the contact plugin is present. The vulnerable behavior is the contact submission handler failing to validate an anti-CSRF token.
What can be done if an update cannot be applied immediately?
Disable the contact plugin or otherwise prevent access to its submission handler until anti-CSRF token validation can be deployed. Users should also avoid interacting with untrusted pages while authenticated, although this is not a complete server-side mitigation.