CSRF to SMTP Configuration Change in Contact Form by Supsystic

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in the Contact Form by Supsystic WordPress plugin before version 1.11.1. It allows an attacker to change the plugin's mail settings without proper verification by tricking a logged-in admin into visiting a malicious page. This could redirect contact form notifications through attacker-controlled servers.

Useful 0 Not Useful 0

Detection Guidance

Check if the Contact Form by Supsystic plugin version is below 1.11.1. Log in as an administrator and inspect the plugin settings for unauthorized changes to mail configuration, such as SMTP server or recipient details.

Useful 0 Not Useful 0

Impact Analysis

An attacker could intercept or manipulate contact form submissions by rerouting emails through their own servers. This might lead to data theft, unauthorized access to sensitive information, or disruption of site functionality if notifications are altered or blocked.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could compromise data protection compliance by exposing user-submitted data to unauthorized parties. GDPR and HIPAA require secure handling of personal and health information; a CSRF attack may lead to breaches, resulting in legal penalties or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Contact Form by Supsystic plugin to version 1.11.1 or later immediately. Review mail settings for unauthorized changes and monitor for suspicious activity.

Useful 0 Not Useful 0