CVE-2019-25734
Cross-Site Request Forgery and Local File Inclusion in Contact Form by WD
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wd | contact_form | 1.13.1 |
| webdorado | contact_form_by_wd | to 1.13.1 (inc) |
| webdorado | contact_form_maker | to 1.13.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2019-25734 is a vulnerability in the Contact Form by WD WordPress plugin version 1.13.1 or earlier. It combines Cross-Site Request Forgery (CSRF) with Local File Inclusion (LFI). This means an attacker can trick the server into including arbitrary files by exploiting unsanitized parameters in the plugin's AJAX endpoint (admin-ajax.php). Specifically, attackers craft malicious forms that use directory traversal sequences in the GET action parameter to bypass authentication and load files they should not have access to.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated attackers to include arbitrary files on the server. This can lead to unauthorized access to sensitive files, potentially exposing confidential information or enabling further attacks on the system. Because the attack bypasses authentication, it poses a significant risk to the security of the affected website.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious requests targeting the admin-ajax.php endpoint with unusual or directory traversal sequences in the GET action parameter.
You can look for HTTP requests containing patterns like '../' or other directory traversal strings in the action parameter to identify potential exploitation attempts.
For example, using command-line tools like curl or grep on web server logs can help detect such attempts.
- grep -i 'admin-ajax.php' /var/log/apache2/access.log | grep -E 'action=.*\.\./'
- tcpdump or Wireshark filters to capture HTTP GET requests to admin-ajax.php containing suspicious action parameters.
- curl -v 'http://yourwebsite.com/wp-admin/admin-ajax.php?action=../../../../etc/passwd' to test if the server responds with unintended file content (only on a test system).
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating or removing the vulnerable Contact Form by WD plugin if possible, as the vulnerability allows unauthenticated attackers to include arbitrary files.
If updating is not possible, restrict access to the admin-ajax.php endpoint to trusted IP addresses or authenticated users to prevent exploitation.
Additionally, implement web application firewall (WAF) rules to block requests containing directory traversal sequences in the action parameter.
Review and sanitize all user inputs in AJAX actions to prevent local file inclusion vulnerabilities.