VULNERABILITY INTELLIGENCE
CVE-2008-0198
CVSS score4.3 MEDIUM
EPSS probability1.28%
CISA KEVNot currently listed
Published2008-01-10
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:N/I:P/A:N
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) wpcf_question, (2) wpcf_success_msg, or (3) wpcf_error_msg parameter to wp-admin/admin.php.
Weakness classification
- CWE-352: Cross-Site Request Forgery (CSRF)
Primary references
- cve@mitre.org — Broken Link, Exploit, Third Party Advisory
- cve@mitre.org — Broken Link, Third Party Advisory
- cve@mitre.org — Broken Link, Third Party Advisory
- cve@mitre.org — Broken Link, Third Party Advisory
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Broken Link, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory